Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:24
Behavioral task
behavioral1
Sample
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
-
Size
431KB
-
MD5
e2b858b0b40d3d998778e17d00787b10
-
SHA1
22850999a548a5982a2c145ae74c1a0dc3e42a87
-
SHA256
9db9ff622a13ce2f91f10aaf7ea77bacb045a2350ef93382766166270f3c813a
-
SHA512
71323ac9b182eb077eee63586ab70fa5ffd12f6397adbdde983c95d00477d3fb2f2e952281fcec7f901a876cce50477189f886a45bb5dc8839292f835c63a520
-
SSDEEP
6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAH:c4Fm3b7yOAHNar4mUf9lJ82scqAH
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Systemjjbpn.exe family_blackmoon -
Deletes itself 1 IoCs
Processes:
Systemjjbpn.exepid process 2576 Systemjjbpn.exe -
Executes dropped EXE 1 IoCs
Processes:
Systemjjbpn.exepid process 2576 Systemjjbpn.exe -
Loads dropped DLL 2 IoCs
Processes:
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exepid process 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exeSystemjjbpn.exepid process 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe 2576 Systemjjbpn.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exedescription pid process target process PID 2512 wrote to memory of 2576 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe Systemjjbpn.exe PID 2512 wrote to memory of 2576 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe Systemjjbpn.exe PID 2512 wrote to memory of 2576 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe Systemjjbpn.exe PID 2512 wrote to memory of 2576 2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe Systemjjbpn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\Systemjjbpn.exe"C:\Users\Admin\AppData\Local\Temp\Systemjjbpn.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85B
MD5dd1fcfd52e099f2e2f3cb111e94bf33b
SHA15d333e8dfc6efb61ac9684080a4986838d3e6924
SHA256fb4761df51040f5b4d09733d2cb70b080a7b49998424b1849f37d88dee9be143
SHA5124f42e2b0694684435d662c26e882f3d9cc3c8bb5d5bfed420f454e699f35c64755e3acab43a18f8a97d32884c97ed24e490689644005296e0ead0da227b7242e
-
Filesize
431KB
MD556c8ea8a78fd7955b0cf0e52fdc1f4f1
SHA1b33a3151222f65c579f3182c6a3cf774e1ad9071
SHA256881aaf0f46a35a08195ca316b38d380b64287183ff7128e86715fff887236af8
SHA5122e1fc6ae4f8299b744cce67cfb16102806c42fad477300974adb6164aec9b4e4bf87add6169827494f5d281f18c1ccf6fb17262a8c9021af04553d926fb792ca