Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 02:20
Behavioral task
behavioral1
Sample
75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
General
- Target 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe
- Size 87KB
- Sample240518-csec3afg3w
- SHA256 775db59e682c29a07f8289186c33c41c08e296ec28352191ac57d38985d4be32
- MD5 75b66d80d1316c82536fabb115108ee0
- SHA1 b872ca3f34b23c7c982334b907b67dacf8bc19e3
- SHA512 5d136768d1980265fe14120c24fd305278d24ee165136c3e22ee8ef7cd16993cf1e6f329d173c9f0bb54493f5c4df11f7ebc008845fbad172809af6bd1fb3437
- SSDEEP 1536:D3ScSeuCQ5CvP3ErbK0GsA1Irn6ykkXERklFceLnFaswUemjmh5WGiirTb9Qyz1:DSleucPUXKhsmIGZkXYUJFg5fRiaTRl
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral2/memory/3216-14-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon behavioral2/memory/2440-15-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon behavioral2/memory/3216-17-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe - Deletes itself 1 IoCs
pid Process 3216 Systemisxkk.exe - Executes dropped EXE 1 IoCs
pid Process 3216 Systemisxkk.exe -
resource yara_rule behavioral2/memory/2440-0-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/files/0x000800000002296f-9.dat upx behavioral2/memory/3216-14-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/memory/2440-15-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/memory/3216-17-0x0000000000400000-0x000000000047E000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe 3216 Systemisxkk.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2440 wrote to memory of 3216 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 100 PID 2440 wrote to memory of 3216 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 100 PID 2440 wrote to memory of 3216 2440 75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\75b66d80d1316c82536fabb115108ee0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\Systemisxkk.exe"C:\Users\Admin\AppData\Local\Temp\Systemisxkk.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4456,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:81⤵PID:1848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Systemisxkk.exe
- Size 87KB
- SHA256 3dc876ca64d318c1db0f596b276ea4af54542dda546a47cda39775ce23808e60
- MD5 1f09b6ac2b52626f7fe4f283fae3dd50
- SHA1 62675fb104a6228b923c60be6ee48070392c5dae
- SHA512 76a9cd2c3fa05a77b17525cf51a32b640b033ccb2fa2d6774a3b22ddb85995dbb431944a7ec84ad88e4918c01e0117bee66d615093a9504416c4611744670a91
- SSDEEP 1536:D3ScSeuCQ5CvP3ErbK0GsA1Irn6ykkXERklFceLnFaswUemjmh5WGiirTb9QyzY:DSleucPUXKhsmIGZkXYUJFg5fRiaTRo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\path.ini
- Size 85B
- SHA256 8a08445b6dc5f8d5156531ede370608874605b6b690a6ec677718a4ad42362c0
- MD5 568d5f713393b2af46b90234e27cba72
- SHA1 ec76019b8245e36f6488c59ca9b1c133b9ed0466
- SHA512 6bed076185432cc2341662e2d8d1aceba73bb82ee419a911d06cc511a201ca1bb163904c1c98fe9f772c86f45af251de5a2e2e77ebfdaaf7341cf65172a4ffc7
- MD5 SHA1 SHA512