Analysis
- max time kernel
150s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
18/05/2024, 00:09
General
- Target 5ad5d8772ed6de609cda84d498893ff0_NeikiAnalytics.exe
- Size 183KB
- Sample240518-afsntaad26
- SHA256 1b84d766587542b7391cd8d715a9c0753b0fe1d9af43b2930cb4383e9f070f52
Score
10/10
Malware Config
Signatures
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Detect Blackmoon payload 64 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ad5d8772ed6de609cda84d498893ff0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5ad5d8772ed6de609cda84d498893ff0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\5pjvd.exec:\5pjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrlflr.exec:\xrrlflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7hbttt.exec:\7hbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvpj.exec:\vpvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrlffx.exec:\ffrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5llfxrr.exec:\5llfxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdddv.exec:\vdddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrxlrx.exec:\lrrxlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btttbb.exec:\btttbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1vppd.exec:\1vppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhhhn.exec:\tbhhhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhbnn.exec:\nbhbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvppd.exec:\dvppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htttnn.exec:\htttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvvj.exec:\pjvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpvp.exec:\pvpvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhbbb.exec:\tnhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjvp.exec:\jdjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1rfxlxr.exec:\1rfxlxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnhtt.exec:\tnnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbtbb.exec:\ttbtbb.exe23⤵
- Executes dropped EXE
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe24⤵
- Executes dropped EXE
-
\??\c:\hnnhhh.exec:\hnnhhh.exe25⤵
- Executes dropped EXE
-
\??\c:\pjppj.exec:\pjppj.exe26⤵
- Executes dropped EXE
-
\??\c:\llxrfff.exec:\llxrfff.exe27⤵
- Executes dropped EXE
-
\??\c:\btttnn.exec:\btttnn.exe28⤵
- Executes dropped EXE
-
\??\c:\9jvpd.exec:\9jvpd.exe29⤵
- Executes dropped EXE
-
\??\c:\thnntt.exec:\thnntt.exe30⤵
- Executes dropped EXE
-
\??\c:\thnhtt.exec:\thnhtt.exe31⤵
- Executes dropped EXE
-
\??\c:\pdpjv.exec:\pdpjv.exe32⤵
- Executes dropped EXE
-
\??\c:\jjjjv.exec:\jjjjv.exe33⤵
- Executes dropped EXE
-
\??\c:\rllxlfx.exec:\rllxlfx.exe34⤵
- Executes dropped EXE
-
\??\c:\nbhhbb.exec:\nbhhbb.exe35⤵
- Executes dropped EXE
-
\??\c:\dvdpp.exec:\dvdpp.exe36⤵
- Executes dropped EXE
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe37⤵
- Executes dropped EXE
-
\??\c:\rrfxlll.exec:\rrfxlll.exe38⤵
- Executes dropped EXE
-
\??\c:\3nhbhh.exec:\3nhbhh.exe39⤵
- Executes dropped EXE
-
\??\c:\vpvpv.exec:\vpvpv.exe40⤵
- Executes dropped EXE
-
\??\c:\xxrfxrr.exec:\xxrfxrr.exe41⤵
- Executes dropped EXE
-
\??\c:\lrrlffx.exec:\lrrlffx.exe42⤵
- Executes dropped EXE
-
\??\c:\nhhhbh.exec:\nhhhbh.exe43⤵
- Executes dropped EXE
-
\??\c:\ttthhb.exec:\ttthhb.exe44⤵
- Executes dropped EXE
-
\??\c:\xlllfxr.exec:\xlllfxr.exe45⤵
- Executes dropped EXE
-
\??\c:\xxxrfff.exec:\xxxrfff.exe46⤵
- Executes dropped EXE
-
\??\c:\vpjdv.exec:\vpjdv.exe47⤵
- Executes dropped EXE
-
\??\c:\vppjv.exec:\vppjv.exe48⤵
- Executes dropped EXE
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe49⤵
- Executes dropped EXE
-
\??\c:\bbtbbb.exec:\bbtbbb.exe50⤵
- Executes dropped EXE
-
\??\c:\5pvpj.exec:\5pvpj.exe51⤵
- Executes dropped EXE
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe52⤵
- Executes dropped EXE
-
\??\c:\1flffff.exec:\1flffff.exe53⤵
- Executes dropped EXE
-
\??\c:\ntttnn.exec:\ntttnn.exe54⤵
- Executes dropped EXE
-
\??\c:\djpjv.exec:\djpjv.exe55⤵
- Executes dropped EXE
-
\??\c:\jvvpp.exec:\jvvpp.exe56⤵
- Executes dropped EXE
-
\??\c:\lflfxxr.exec:\lflfxxr.exe57⤵
- Executes dropped EXE
-
\??\c:\nbbnhb.exec:\nbbnhb.exe58⤵
- Executes dropped EXE
-
\??\c:\5ttnhh.exec:\5ttnhh.exe59⤵
- Executes dropped EXE
-
\??\c:\pjpjd.exec:\pjpjd.exe60⤵
- Executes dropped EXE
-
\??\c:\ppjdp.exec:\ppjdp.exe61⤵
- Executes dropped EXE
-
\??\c:\rlrrllr.exec:\rlrrllr.exe62⤵
- Executes dropped EXE
-
\??\c:\rfffxxr.exec:\rfffxxr.exe63⤵
- Executes dropped EXE
-
\??\c:\btbbtt.exec:\btbbtt.exe64⤵
- Executes dropped EXE
-
\??\c:\dvvvp.exec:\dvvvp.exe65⤵
- Executes dropped EXE
-
\??\c:\jdvpp.exec:\jdvpp.exe66⤵
-
\??\c:\rllrffl.exec:\rllrffl.exe67⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe68⤵
-
\??\c:\bbtnbb.exec:\bbtnbb.exe69⤵
-
\??\c:\jvpjv.exec:\jvpjv.exe70⤵
-
\??\c:\xlrfxrx.exec:\xlrfxrx.exe71⤵
-
\??\c:\5fffxfr.exec:\5fffxfr.exe72⤵
-
\??\c:\htbtnt.exec:\htbtnt.exe73⤵
-
\??\c:\vvddv.exec:\vvddv.exe74⤵
-
\??\c:\frfrlfx.exec:\frfrlfx.exe75⤵
-
\??\c:\tbttnn.exec:\tbttnn.exe76⤵
-
\??\c:\vdpvp.exec:\vdpvp.exe77⤵
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe78⤵
-
\??\c:\tnntnh.exec:\tnntnh.exe79⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe80⤵
-
\??\c:\xflflfl.exec:\xflflfl.exe81⤵
-
\??\c:\ffxlffx.exec:\ffxlffx.exe82⤵
-
\??\c:\tthhnt.exec:\tthhnt.exe83⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe84⤵
-
\??\c:\rxfxxfx.exec:\rxfxxfx.exe85⤵
-
\??\c:\lfxrrff.exec:\lfxrrff.exe86⤵
-
\??\c:\pdjdp.exec:\pdjdp.exe87⤵
-
\??\c:\vjdpv.exec:\vjdpv.exe88⤵
-
\??\c:\xfffrxf.exec:\xfffrxf.exe89⤵
-
\??\c:\nnntnn.exec:\nnntnn.exe90⤵
-
\??\c:\pppjv.exec:\pppjv.exe91⤵
-
\??\c:\3djdj.exec:\3djdj.exe92⤵
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe93⤵
-
\??\c:\nbttnb.exec:\nbttnb.exe94⤵
-
\??\c:\thbtnn.exec:\thbtnn.exe95⤵
-
\??\c:\jddvv.exec:\jddvv.exe96⤵
-
\??\c:\vppjv.exec:\vppjv.exe97⤵
-
\??\c:\lfrrlll.exec:\lfrrlll.exe98⤵
-
\??\c:\tnhnnn.exec:\tnhnnn.exe99⤵
-
\??\c:\bttthh.exec:\bttthh.exe100⤵
-
\??\c:\pvjjv.exec:\pvjjv.exe101⤵
-
\??\c:\pjvpj.exec:\pjvpj.exe102⤵
-
\??\c:\xlrrllf.exec:\xlrrllf.exe103⤵
-
\??\c:\nhbbth.exec:\nhbbth.exe104⤵
-
\??\c:\hbhbbb.exec:\hbhbbb.exe105⤵
-
\??\c:\3vpjd.exec:\3vpjd.exe106⤵
-
\??\c:\lxlffff.exec:\lxlffff.exe107⤵
-
\??\c:\rllxrrr.exec:\rllxrrr.exe108⤵
-
\??\c:\vjjpj.exec:\vjjpj.exe109⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe110⤵
-
\??\c:\rrllfff.exec:\rrllfff.exe111⤵
-
\??\c:\lrrllll.exec:\lrrllll.exe112⤵
-
\??\c:\7thttb.exec:\7thttb.exe113⤵
-
\??\c:\dppvp.exec:\dppvp.exe114⤵
-
\??\c:\rlrrlll.exec:\rlrrlll.exe115⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe116⤵
-
\??\c:\dddvp.exec:\dddvp.exe117⤵
-
\??\c:\ppjvp.exec:\ppjvp.exe118⤵
-
\??\c:\lfrllfl.exec:\lfrllfl.exe119⤵
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe120⤵
-
\??\c:\tnnntt.exec:\tnnntt.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-