fe2140b01839570b839b558515b05d662d3cc9cac87b3663f36553a9d55eafc5

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
Size 90KB
Sample240617-hm64saygpg
SHA256 fe2140b01839570b839b558515b05d662d3cc9cac87b3663f36553a9d55eafc5
MD5 5d162b7afe6cc12b5497bb7e1366c7f0
SHA1 5a04b3c3ad9382461409ac6c654a7d9f30020a05
SHA512 03ac17441c363315aebd180c8af99add5f88433eb3251aa248ab80ebc9a0270c299fc38862b2aff2f13e1a5334346ef511c795b0e403b65633785ad99db90dc7
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8FwQ/4mCB:fnyiQSoywQ/4mCB
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1296) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4176-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002325b-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/4176-418-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Extensions.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClient.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClientSideProviders.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClientSideProviders.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClient.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.EventBasedAsync.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.deps.json.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Printing.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.Primitives.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationClientSideProviders.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\wpfgfx_cor3.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.TypeExtensions.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Security.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ObjectModel.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.ServicePoint.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationTypes.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Handles.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationUI.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Channels.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationTypes.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Xaml.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.ProtectedData.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.FileVersionInfo.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationCore.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.ResourceManager.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationFramework.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClientSideProviders.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.Common.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Timer.dll.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 90KB
SHA256 f826243160878555a7623c504eed5ed8fafe010aeaef5f19f34aaf801d431a21
MD5 1024bcf23ade26cf3f42a047545a80a3
SHA1 675a295f6692350b6881a635000d424481159626
SHA512 73cae1762f96d2f06fc72c02c42ba1fac8eedeb8bbdd0ba5420d36c96642b42b2902a07b494c08fab0d5bb9f491c3998d622a7580188ed3443070613b7aaf36e
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8FwQ/4mCt:fnyiQSoywQ/4mCt
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 90KB
SHA256 4478ecc7ef7a3f09f749ea634127982878219d344cfb0853647529277d82c509
MD5 d00dd9ca38f2908f7286f061102697c8
SHA1 06ffea3e7abd8df2dd4489f2f19a1d6efd562a0f
SHA512 a2c2a99ce58e6b58553d24a73a0c5781fb2aac80666836f1f1b706c7b49d1f341d2b727218905972f20cb42b081b34ee2b41e42955a2b83226b1579e34bfdf3c
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8FwQ/4mC7:fnyiQSoywQ/4mC7
MD5 SHA1 SHA512 SSDEEP