Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
13-05-2024 16:36
General
-
Target
be780bcdb9a3cd5a8b4b9840433ac9f0_NeikiAnalytics.exe
-
Size
1.0MB
-
MD5
be780bcdb9a3cd5a8b4b9840433ac9f0
-
SHA1
b54ad3e4a69a878bbecd9e4be24077126d11b6e8
-
SHA256
a81a2cef02dd0eb36b589345429bbd67c51933246d6d0a1e6a5b676ea5bef804
-
SHA512
6e2e7394e7c390f842cc3383bb1a62ff0d18a3094e5e9e6afd0e02ecaf61e17fb008cba560766e6fb1e3e37ecdf186c08afad516dbb37fe9b9432da7fe476854
-
SSDEEP
24576:VEeG1Gv/aSmn77FP/Dpn/JTM/3iVIwSa/l:VEvGnaS8vFnDLk3EIwS
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be780bcdb9a3cd5a8b4b9840433ac9f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\be780bcdb9a3cd5a8b4b9840433ac9f0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\zabucr\Agghosts.exe"C:\zabucr\Agghosts.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD55aab297fa8f143bfa67310ad78b76d3f
SHA15db963c2cca1bc8c8c060c52f7df76ccb477f01a
SHA2568ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df
SHA512c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256
-
Filesize
157KB
MD5c1e4b112fb3a145e42ddea34f47033e1
SHA1e62dde9931108e6a26239e9faf6c770b63b5b381
SHA2569a2e8017e6c3eac3fe203630f805f0ec1f9a08b73d409f8076466f33db9fb6e0
SHA512d086b878007103a8408a442b29b8571d706f8b788234b491ac70a61d115766165a14430679930051787ac354c6cdccd84aa778331f6d2855eaa426dd5b9ae0c4
-
Filesize
536KB
MD53ac57b27cb56ba11a3c96426bdc6d7d9
SHA1b4ad69727c12a004484a9a45e5914a43c2f7d877
SHA256eacd208cedc90a0a97c802de48ac252f6374b276ab3a47daa5ecd4587a502802
SHA51219108594cf70b4aa87fdcc55d078639c6b7fc8cc83d98aac88f3bf89ff67f620cf7cc2a814b1b5c86ab562314443f2630a3e49a80b552556fe79114e6b8a43b2
-
Filesize
123KB
MD55e426092839f4fb2b77b10968500b6f7
SHA196e0be8e3975f93d429b27869fe3353c8462757b
SHA256ed419431870a7bf25a04d1919023837b350f5956f05d683cc25ef0debf47e69c
SHA5129c1d55ff14d57711d2f3a4fb04adf62f2a186ef7b4160ca37178a413ebb3b20c703d9380e6d54b3d03a4e1cd97b44f66cf6f5a67028e1a4cc34e74f576915a46
-
Filesize
77KB
MD5f107a3c7371c4543bd3908ba729dd2db
SHA1af8e7e8f446de74db2f31d532e46eab8bbf41e0a
SHA25600df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0
SHA512fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530
-
Filesize
4KB
-
Filesize
164KB
