83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
Size 58KB
Sample240629-jkpbmatdkb
SHA256 83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98
MD5 786048a875b9136579b537d6101e87c0
SHA1 48fa26c351fec46acf6e5272232923312c8bb103
SHA512 6aedbc95550ebac53348acc684700bfd33c1ac73dc013ebcee707d9061a3fa530586dbcd2f59623b5c2f5a826e8c4c8954aeda48bff2334de94088ea1c9a1559
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYlaaGaax:KQSoskRYE
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1843) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4848-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023256-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/4848-350-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\ReachFramework.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\PresentationUI.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\WindowsBase.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Accessibility.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationCore.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebSockets.Client.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Input.Manipulations.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\ReachFramework.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.Client.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemXml.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Immutable.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Json.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\WindowsFormsIntegration.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.RegularExpressions.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Threading.AccessControl.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\WindowsFormsIntegration.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Pkcs.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Xml.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Xml.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Threading.AccessControl.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\83a6b44ce7077fd93ac38d2a3afe547b97c62dbe1a34171c3144935fbbbb8c98_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 58KB
SHA256 e2d54eb2b43fdfe472b5baef4cb8afa49c0e027e9e47b5bea33a5cf042728d5f
MD5 ad0fbaf2e16e6f5808997cc2927a8f47
SHA1 c60a7e4818e0e54cb8fef84624c6aa21dd9c2c35
SHA512 be5cfda7d857403852c5101b1aa9425d2c5f77a72b6d84f12070a6c83fbb493ad844120c254538019405ae162c69e94b1765d40ae9348bf0fe9e4d0e9b79a482
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYlaaGaaa:KQSoskRYr
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 58KB
SHA256 d4c3a0c02bdc1f699b23b7a5a7d151fc84027aba52450e2744769e9fcdd2dcca
MD5 8e581f809851a8e77a3a4b46ada5a000
SHA1 dc82ecfec3fd6dc8a739c9ac0762e1455274b52c
SHA512 216cb06a4c774e5f603e2873e8a619cd7ab8d5fa7e3d8ded74250c4450c9808830fa0dbf91becf396ec7baf123ef9b475553a38a842e7ca8eb004228ef8633e5
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYlaaGaav:KQSoskRY6
MD5 SHA1 SHA512 SSDEEP