Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 17:16
Behavioral task
behavioral1
Sample
fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe
-
Size
431KB
-
MD5
fe5c078f4c2a9db24d6753b072789fd0
-
SHA1
a4ac4c28b54a2b1977b0ec0214880b8da27dd0fa
-
SHA256
fd02c10d5ac1eb5af6f3eb11716b5528c5fac13b099e1cf741f2320503f56374
-
SHA512
f2bfe0426b9283909eb9d3fe32cbb87eee79dc225cc4156d654947c1bdf0f0912a1a3ee4a76b69df07c3e654d48fa13c1f93e6c8ccd35576c5d40b20903b0d20
-
SSDEEP
3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUh:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+m
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Systemvttuq.exe family_blackmoon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe -
Deletes itself 1 IoCs
Processes:
Systemvttuq.exepid process 1544 Systemvttuq.exe -
Executes dropped EXE 1 IoCs
Processes:
Systemvttuq.exepid process 1544 Systemvttuq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exeSystemvttuq.exepid process 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe 1544 Systemvttuq.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exedescription pid process target process PID 1916 wrote to memory of 1544 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe Systemvttuq.exe PID 1916 wrote to memory of 1544 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe Systemvttuq.exe PID 1916 wrote to memory of 1544 1916 fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe Systemvttuq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fe5c078f4c2a9db24d6753b072789fd0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\Systemvttuq.exe"C:\Users\Admin\AppData\Local\Temp\Systemvttuq.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4100,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:81⤵PID:464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
431KB
MD55dbbdec6ffd5fb33e1a829c4174d0d07
SHA114fe913d6eccc70bcd5c9b8a101cb3709a018399
SHA256fdb7555675b5b55538bbd7b60cca64c1d637875966097d8ffb6cab1aec6d049a
SHA512078e0cb6510c673f9a251a931d96cb006b6a4e26f70b5c1789558051618cf020ae0b8735e601df17e49317288de0faa9c6bfb4ad97e87d223d3f7d9cab1d8aa0
-
Filesize
85B
MD51454dc12aca611bcb53b3d212385c61c
SHA1ce3958ccb5a6f5361b5a872075eb116911f26df4
SHA25674cd9a0492e7e10e40c8f6a08d8d6297eca33acf8c8f05104da280b086ee2504
SHA5124b4d65b396d41368fd828dee35e5067cd26c2643da120a9502fb149005dd836dc37f60085c2051d7f5eb2ab7e1743009c35971285f67592c0ba29043d6e6b622