Analysis
- max time kernel
148s - max time network
121s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
19/05/2024, 22:23
Behavioral task
behavioral1
Sample
4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
General
- Target 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe
- Size 440KB
- Sample240519-2a24vadf7x
- SHA256 934d4399b08eb4a0f7d0a7e3fa1da96d9f480e0159222e2fc774ffedaa735319
- MD5 4ad42d43445abc102688f86e89ace170
- SHA1 2b8e9d9711b10e911f3bff1e6e40644fe3d3497d
- SHA512 9a769e69e51edde22f5de02f0f3d5c37e21774578c0ba6400202a9f22d64c39ee1a07b4c3f616fedbcaea1af2c5bd4a88f3d33f837deeb25080781bd1303f23b
- SSDEEP 6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAO:xgXQKSLpOCtV0R8xMSaAO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/files/0x000b0000000139b4-7.dat family_blackmoon - Deletes itself 1 IoCs
pid Process 2636 Syslempzpoh.exe - Executes dropped EXE 1 IoCs
pid Process 2636 Syslempzpoh.exe - Loads dropped DLL 2 IoCs
pid Process 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe 2636 Syslempzpoh.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2636 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 29 PID 2412 wrote to memory of 2636 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 29 PID 2412 wrote to memory of 2636 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 29 PID 2412 wrote to memory of 2636 2412 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\Syslempzpoh.exe"C:\Users\Admin\AppData\Local\Temp\Syslempzpoh.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\lpath.ini
- Size 85B
- SHA256 e022fad9e74339a0fc8444066faee921752a33339f2a45d54c127e824cf02489
- MD5 1c778de49cabbd71130a5db8e40acdfc
- SHA1 ef043b8d5b3253dffe23b254fb43293b74c7dd08
- SHA512 2f1a94a88576bd7c779e6b293a575f423f2df4724ee1047aac49f3f28340cb481426945f631c2e5de57549d17c74978175005580ed2d365e4487baba4e136382
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\Syslempzpoh.exe
- Size 440KB
- SHA256 1773facd9c2f61b57b79bcc4c85a23ea7fbbd56cf9da8b590cf2f54e2d112184
- MD5 72ee1eb0ab772c0f839dcf78542ee500
- SHA1 76612bf6afa8c440a3f826e7102eca626e1832bd
- SHA512 9d498d3ddf559651d7166847834c8bb23afb12ed43e6d39c1c144177b79f1b13dbb2adcbbf459089e6b278bb0aff710f5859fa79ec4b3aaf13885c7d629d1cde
- SSDEEP 6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAI:xgXQKSLpOCtV0R8xMSaAI
- MD5 SHA1 SHA512 SSDEEP