Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:24
Behavioral task
behavioral1
Sample
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
-
Size
431KB
-
MD5
e2b858b0b40d3d998778e17d00787b10
-
SHA1
22850999a548a5982a2c145ae74c1a0dc3e42a87
-
SHA256
9db9ff622a13ce2f91f10aaf7ea77bacb045a2350ef93382766166270f3c813a
-
SHA512
71323ac9b182eb077eee63586ab70fa5ffd12f6397adbdde983c95d00477d3fb2f2e952281fcec7f901a876cce50477189f886a45bb5dc8839292f835c63a520
-
SSDEEP
6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAH:c4Fm3b7yOAHNar4mUf9lJ82scqAH
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Systemmmjxu.exe family_blackmoon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe -
Deletes itself 1 IoCs
Processes:
Systemmmjxu.exepid process 3340 Systemmmjxu.exe -
Executes dropped EXE 1 IoCs
Processes:
Systemmmjxu.exepid process 3340 Systemmmjxu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exeSystemmmjxu.exepid process 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe 3340 Systemmmjxu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exedescription pid process target process PID 1900 wrote to memory of 3340 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe Systemmmjxu.exe PID 1900 wrote to memory of 3340 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe Systemmmjxu.exe PID 1900 wrote to memory of 3340 1900 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe Systemmmjxu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\Systemmmjxu.exe"C:\Users\Admin\AppData\Local\Temp\Systemmmjxu.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3340
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:4848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
431KB
MD570667cb7d2baf3e33f0643c1cb6d716f
SHA144914b7c1cff38594d7cf12b303ff7bf962eb36c
SHA256846701ac1470548f9f5294ccabb20bd2af7e8b2d93e146f3c39da520f2d52721
SHA51209e7a11692426cbbb228155abf23b8a2b6a641d2953407e9b630f7f4a22f37424f3435eda129b10dc62ea6e94950ce13f4fd83ca61e8bb7cb79c1d51e72415f1
-
Filesize
85B
MD5dd1fcfd52e099f2e2f3cb111e94bf33b
SHA15d333e8dfc6efb61ac9684080a4986838d3e6924
SHA256fb4761df51040f5b4d09733d2cb70b080a7b49998424b1849f37d88dee9be143
SHA5124f42e2b0694684435d662c26e882f3d9cc3c8bb5d5bfed420f454e699f35c64755e3acab43a18f8a97d32884c97ed24e490689644005296e0ead0da227b7242e