Malware Analysis Report

2025-08-05 19:56

Sample ID 240518-q4pvtsed4y
Target d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe
SHA256 fc7722f549ca808898965510f3b39a288314c7913204fef1f1f43b1b3de150d4
Tags
blackmoon banker trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fc7722f549ca808898965510f3b39a288314c7913204fef1f1f43b1b3de150d4

Threat Level: Known bad

The file d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

blackmoon banker trojan

Blackmoon, KrBanker

Blackmoon family

Detect Blackmoon payload

Loads dropped DLL

Deletes itself

Executes dropped EXE

Checks computer location settings

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-18 13:49

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 13:49

Reported

2024-05-18 13:51

Platform

win7-20231129-en

Max time kernel

148s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe

"C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp

Files

C:\Users\Admin\AppData\Local\Temp\Systemhgijj.exe

MD5 be4a5bac28bebe9ffd2ea6ad65099e1b
SHA1 8621fb34d4bae60864fc642ab4738255e908c6dd
SHA256 948d44d32dbd3cd44ca7a79693a2e04ae340c81aa732997dec9a34ca348c38e0
SHA512 e252d6bbbdb10a6b62d3f4f0be78c322a59566abd584817c7acca2155533938142d0a4c5b96088de6e11e40d965a693e0953c8ee9288464fd4b152c0ba11eb78

C:\Users\Admin\AppData\Local\Temp\fpath.ini

MD5 cac8f47d93a5cca20160366f21cc5589
SHA1 76b39ae065f3fe14863f843a5bac5e1e1c4eef66
SHA256 e1615f5084bb8bca90b68a128348356e9b0c04ee1f91ae31bbc74b8823f6a502
SHA512 6c6c2b1f0e9a09c2ea4f70272c9e8f31a8c9e810f73a6c8e41d85986819416d7e360b2ac29f1efbd4c1a055551b9d6f37711ad3e598365994a922c98f6d46320

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-18 13:49

Reported

2024-05-18 13:51

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\d1522c355d1ec4696eea35498389ad80_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe

"C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 75.61.62.23.in-addr.arpa udp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Systemriwwd.exe

MD5 6baa2494981900654587eaef76792708
SHA1 ff5357a96a62f673eb9de69715d46f9e5c4027b9
SHA256 f007350593dd857cc124c0403994caed130e9f65d6c3cadf5639bd58b766947a
SHA512 940d694c895d1620324bed7291e1eb769b4e4e01eea2109eca360d9a62e3837174309a268e110f4e0ccf655195ec317194d282330f0bb87875fd95c71ee90ccf

C:\Users\Admin\AppData\Local\Temp\fpath.ini

MD5 cac8f47d93a5cca20160366f21cc5589
SHA1 76b39ae065f3fe14863f843a5bac5e1e1c4eef66
SHA256 e1615f5084bb8bca90b68a128348356e9b0c04ee1f91ae31bbc74b8823f6a502
SHA512 6c6c2b1f0e9a09c2ea4f70272c9e8f31a8c9e810f73a6c8e41d85986819416d7e360b2ac29f1efbd4c1a055551b9d6f37711ad3e598365994a922c98f6d46320