Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 03:33
Behavioral task
behavioral1
Sample
6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe
-
Size
1.6MB
-
MD5
6ea40c2d02ba5d8f0eec8c3776160050
-
SHA1
773b915271faec00d48d469130dd25bc305b5a80
-
SHA256
1da94573936cb39e711d0756429bbbc73ac80183632aeebeca54156ad24c6186
-
SHA512
46166ae388de55a0623aa347eb9443d8d569043a06dc520b8f1f4b1a9dcc9a39536e0ed555fde71021a55d312c43c30c65fb1fd6a56187e85b4e558a61770395
-
SSDEEP
24576:zYxIAZwWIGiEz/1CUOys8vf9bHMbjshvE/R6njW+qOziufuGebc:zgIAZwWzNvO6flfmRktqDOuGS
Malware Config
Signatures
-
Detect Blackmoon payload 5 IoCs
resource yara_rule behavioral2/memory/2072-3-0x0000000002540000-0x000000000256E000-memory.dmp family_blackmoon behavioral2/memory/2072-12-0x0000000002540000-0x000000000256E000-memory.dmp family_blackmoon behavioral2/memory/3612-15-0x00000000025A0000-0x00000000025CE000-memory.dmp family_blackmoon behavioral2/memory/5192-20-0x0000000000AC0000-0x0000000000AEE000-memory.dmp family_blackmoon behavioral2/memory/5192-24-0x0000000000AC0000-0x0000000000AEE000-memory.dmp family_blackmoon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
pid Process 3612 MLclRLRrUZ.exe 5192 MLclRLRrUZ.exe -
resource yara_rule behavioral2/memory/5192-21-0x0000000002540000-0x000000000254B000-memory.dmp upx behavioral2/memory/5192-22-0x0000000002540000-0x000000000254B000-memory.dmp upx behavioral2/memory/5192-25-0x0000000002540000-0x000000000254B000-memory.dmp upx -
resource yara_rule behavioral2/memory/2072-0-0x0000000000400000-0x0000000000706000-memory.dmp vmprotect behavioral2/memory/2072-1-0x0000000000400000-0x0000000000706000-memory.dmp vmprotect behavioral2/files/0x00090000000233ef-5.dat vmprotect behavioral2/memory/3612-7-0x0000000000400000-0x0000000000706000-memory.dmp vmprotect behavioral2/memory/2072-11-0x0000000000400000-0x0000000000706000-memory.dmp vmprotect behavioral2/memory/3612-13-0x0000000000400000-0x0000000000706000-memory.dmp vmprotect behavioral2/memory/3612-18-0x0000000000400000-0x0000000000706000-memory.dmp vmprotect behavioral2/memory/5192-19-0x0000000000400000-0x0000000000706000-memory.dmp vmprotect behavioral2/memory/5192-23-0x0000000000400000-0x0000000000706000-memory.dmp vmprotect -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\MLclRLRrUZ.exe 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\MLclRLRrUZ.exe 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe File created C:\Windows\system32\MLclRLRrUZ.exe MLclRLRrUZ.exe File opened for modification C:\Windows\system32\MLclRLRrUZ.exe MLclRLRrUZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1016 PING.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 3612 MLclRLRrUZ.exe 5192 MLclRLRrUZ.exe 5192 MLclRLRrUZ.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 3612 MLclRLRrUZ.exe 5192 MLclRLRrUZ.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2072 wrote to memory of 3612 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 82 PID 2072 wrote to memory of 3612 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 82 PID 2072 wrote to memory of 3612 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 82 PID 2072 wrote to memory of 1628 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 83 PID 2072 wrote to memory of 1628 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 83 PID 2072 wrote to memory of 1628 2072 6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe 83 PID 1628 wrote to memory of 1016 1628 cmd.exe 85 PID 1628 wrote to memory of 1016 1628 cmd.exe 85 PID 1628 wrote to memory of 1016 1628 cmd.exe 85 PID 3612 wrote to memory of 5192 3612 MLclRLRrUZ.exe 88 PID 3612 wrote to memory of 5192 3612 MLclRLRrUZ.exe 88 PID 3612 wrote to memory of 5192 3612 MLclRLRrUZ.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6ea40c2d02ba5d8f0eec8c3776160050_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\MLclRLRrUZ.exe-auto C:\Windows\system32\\MLclRLRrUZ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\system32\MLclRLRrUZ.exe-troj3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5192
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" cmd/c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\[email protected] > nul && exit2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:1016
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD56ea40c2d02ba5d8f0eec8c3776160050
SHA1773b915271faec00d48d469130dd25bc305b5a80
SHA2561da94573936cb39e711d0756429bbbc73ac80183632aeebeca54156ad24c6186
SHA51246166ae388de55a0623aa347eb9443d8d569043a06dc520b8f1f4b1a9dcc9a39536e0ed555fde71021a55d312c43c30c65fb1fd6a56187e85b4e558a61770395