Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 22:23
Behavioral task
behavioral1
Sample
4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
General
- Target 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe
- Size 440KB
- Sample240519-2a24vadf7x
- SHA256 934d4399b08eb4a0f7d0a7e3fa1da96d9f480e0159222e2fc774ffedaa735319
- MD5 4ad42d43445abc102688f86e89ace170
- SHA1 2b8e9d9711b10e911f3bff1e6e40644fe3d3497d
- SHA512 9a769e69e51edde22f5de02f0f3d5c37e21774578c0ba6400202a9f22d64c39ee1a07b4c3f616fedbcaea1af2c5bd4a88f3d33f837deeb25080781bd1303f23b
- SSDEEP 6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAO:xgXQKSLpOCtV0R8xMSaAO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral2/files/0x000900000002335e-8.dat family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe - Deletes itself 1 IoCs
pid Process 2756 Syslemrqhcz.exe - Executes dropped EXE 1 IoCs
pid Process 2756 Syslemrqhcz.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe 2756 Syslemrqhcz.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1176 wrote to memory of 2756 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 89 PID 1176 wrote to memory of 2756 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 89 PID 1176 wrote to memory of 2756 1176 4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4ad42d43445abc102688f86e89ace170_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\Syslemrqhcz.exe"C:\Users\Admin\AppData\Local\Temp\Syslemrqhcz.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Syslemrqhcz.exe
- Size 440KB
- SHA256 aaf6ea0a291f1244933be09edcb7000848ec147af5d98035d98fcc32b4e735e3
- MD5 ee38a787bda556a18df887346ba01463
- SHA1 00f593592c3f053c0611b9e93f68b2a8fc1773dc
- SHA512 cb16636887fa427f928448dcf10ccd2dbe5c3b76e690fe021827188625d98a7274650126a4f61ba90f4b500051913f68e79d5feb8cfae5a2837909fa52e9a48e
- SSDEEP 6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAN:xgXQKSLpOCtV0R8xMSaAN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\lpath.ini
- Size 85B
- SHA256 e022fad9e74339a0fc8444066faee921752a33339f2a45d54c127e824cf02489
- MD5 1c778de49cabbd71130a5db8e40acdfc
- SHA1 ef043b8d5b3253dffe23b254fb43293b74c7dd08
- SHA512 2f1a94a88576bd7c779e6b293a575f423f2df4724ee1047aac49f3f28340cb481426945f631c2e5de57549d17c74978175005580ed2d365e4487baba4e136382
- MD5 SHA1 SHA512