Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
19/05/2024, 19:02
General
- Target 1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe
- Size 122KB
- Sample240519-xqabjsch69
- SHA256 a5bf35b082de71c42a8a99b9245a84d71d874ac754db166300774dd43d10cb18
Score
10/10
Malware Config
Signatures
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Detect Blackmoon payload 23 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbhhn.exec:\bhbhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jpdp.exec:\9jpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllxllx.exec:\xllxllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxxlfxl.exec:\xxxlfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnnht.exec:\ttnnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvd.exec:\jvdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrllxfx.exec:\lrllxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnnbn.exec:\htnnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpdvd.exec:\jpdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1flfxxl.exec:\1flfxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttnhh.exec:\bttnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1vpjv.exec:\1vpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9flflfr.exec:\9flflfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9hbnhn.exec:\9hbnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfxlfrl.exec:\xfxlfrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbtnh.exec:\nhbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjdv.exec:\pdjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flrffxf.exec:\flrffxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxfxfl.exec:\lxxfxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthhht.exec:\tthhht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjpj.exec:\jvjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe23⤵
- Executes dropped EXE
-
\??\c:\nhnhbh.exec:\nhnhbh.exe24⤵
- Executes dropped EXE
-
\??\c:\nnthbt.exec:\nnthbt.exe25⤵
- Executes dropped EXE
-
\??\c:\pjdvp.exec:\pjdvp.exe26⤵
- Executes dropped EXE
-
\??\c:\xrllxrl.exec:\xrllxrl.exe27⤵
- Executes dropped EXE
-
\??\c:\nttnbh.exec:\nttnbh.exe28⤵
- Executes dropped EXE
-
\??\c:\dvpvj.exec:\dvpvj.exe29⤵
- Executes dropped EXE
-
\??\c:\9ffxllx.exec:\9ffxllx.exe30⤵
- Executes dropped EXE
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe31⤵
- Executes dropped EXE
-
\??\c:\hbhnbh.exec:\hbhnbh.exe32⤵
- Executes dropped EXE
-
\??\c:\hbhbtn.exec:\hbhbtn.exe33⤵
- Executes dropped EXE
-
\??\c:\dvpjv.exec:\dvpjv.exe34⤵
- Executes dropped EXE
-
\??\c:\xrxxlll.exec:\xrxxlll.exe35⤵
- Executes dropped EXE
-
\??\c:\tntnhh.exec:\tntnhh.exe36⤵
- Executes dropped EXE
-
\??\c:\jdvpj.exec:\jdvpj.exe37⤵
- Executes dropped EXE
-
\??\c:\vpjvj.exec:\vpjvj.exe38⤵
- Executes dropped EXE
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe39⤵
- Executes dropped EXE
-
\??\c:\3thbhh.exec:\3thbhh.exe40⤵
- Executes dropped EXE
-
\??\c:\dppjd.exec:\dppjd.exe41⤵
- Executes dropped EXE
-
\??\c:\dvdvp.exec:\dvdvp.exe42⤵
- Executes dropped EXE
-
\??\c:\lffrrxr.exec:\lffrrxr.exe43⤵
- Executes dropped EXE
-
\??\c:\5ntnhb.exec:\5ntnhb.exe44⤵
- Executes dropped EXE
-
\??\c:\nthnht.exec:\nthnht.exe45⤵
- Executes dropped EXE
-
\??\c:\ddjpp.exec:\ddjpp.exe46⤵
- Executes dropped EXE
-
\??\c:\xrrlllr.exec:\xrrlllr.exe47⤵
- Executes dropped EXE
-
\??\c:\nhnbhb.exec:\nhnbhb.exe48⤵
- Executes dropped EXE
-
\??\c:\pdvdv.exec:\pdvdv.exe49⤵
- Executes dropped EXE
-
\??\c:\pdjdd.exec:\pdjdd.exe50⤵
- Executes dropped EXE
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe51⤵
- Executes dropped EXE
-
\??\c:\fxrllrx.exec:\fxrllrx.exe52⤵
- Executes dropped EXE
-
\??\c:\3bnbth.exec:\3bnbth.exe53⤵
- Executes dropped EXE
-
\??\c:\ddddv.exec:\ddddv.exe54⤵
- Executes dropped EXE
-
\??\c:\1dvpp.exec:\1dvpp.exe55⤵
- Executes dropped EXE
-
\??\c:\xfxlrlr.exec:\xfxlrlr.exe56⤵
- Executes dropped EXE
-
\??\c:\rrfrllr.exec:\rrfrllr.exe57⤵
- Executes dropped EXE
-
\??\c:\tntnbh.exec:\tntnbh.exe58⤵
- Executes dropped EXE
-
\??\c:\7pjdp.exec:\7pjdp.exe59⤵
- Executes dropped EXE
-
\??\c:\pppvp.exec:\pppvp.exe60⤵
- Executes dropped EXE
-
\??\c:\llllxll.exec:\llllxll.exe61⤵
- Executes dropped EXE
-
\??\c:\hbttnh.exec:\hbttnh.exe62⤵
- Executes dropped EXE
-
\??\c:\thhtht.exec:\thhtht.exe63⤵
- Executes dropped EXE
-
\??\c:\ppvpj.exec:\ppvpj.exe64⤵
- Executes dropped EXE
-
\??\c:\dpdvj.exec:\dpdvj.exe65⤵
- Executes dropped EXE
-
\??\c:\llxrxxr.exec:\llxrxxr.exe66⤵
-
\??\c:\htnhtt.exec:\htnhtt.exe67⤵
-
\??\c:\tnnhth.exec:\tnnhth.exe68⤵
-
\??\c:\vjjdj.exec:\vjjdj.exe69⤵
-
\??\c:\frfxllf.exec:\frfxllf.exe70⤵
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe71⤵
-
\??\c:\tbbttt.exec:\tbbttt.exe72⤵
-
\??\c:\dpvjv.exec:\dpvjv.exe73⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe74⤵
-
\??\c:\xllxlxr.exec:\xllxlxr.exe75⤵
-
\??\c:\rfllxrl.exec:\rfllxrl.exe76⤵
-
\??\c:\nntnbt.exec:\nntnbt.exe77⤵
-
\??\c:\htbtnn.exec:\htbtnn.exe78⤵
-
\??\c:\jvdpp.exec:\jvdpp.exe79⤵
-
\??\c:\frfffff.exec:\frfffff.exe80⤵
-
\??\c:\fxrlrlx.exec:\fxrlrlx.exe81⤵
-
\??\c:\5bnnnb.exec:\5bnnnb.exe82⤵
-
\??\c:\nbbbbh.exec:\nbbbbh.exe83⤵
-
\??\c:\pddjj.exec:\pddjj.exe84⤵
-
\??\c:\vjdvj.exec:\vjdvj.exe85⤵
-
\??\c:\5xfrffl.exec:\5xfrffl.exe86⤵
-
\??\c:\ntnnbb.exec:\ntnnbb.exe87⤵
-
\??\c:\thtnhb.exec:\thtnhb.exe88⤵
-
\??\c:\jpvjj.exec:\jpvjj.exe89⤵
-
\??\c:\lrxflxl.exec:\lrxflxl.exe90⤵
-
\??\c:\rxxrflx.exec:\rxxrflx.exe91⤵
-
\??\c:\bnnnhn.exec:\bnnnhn.exe92⤵
-
\??\c:\tbnnnb.exec:\tbnnnb.exe93⤵
-
\??\c:\jdvjv.exec:\jdvjv.exe94⤵
-
\??\c:\3vpjd.exec:\3vpjd.exe95⤵
-
\??\c:\xlxxfff.exec:\xlxxfff.exe96⤵
-
\??\c:\rfflfxr.exec:\rfflfxr.exe97⤵
-
\??\c:\httnnh.exec:\httnnh.exe98⤵
-
\??\c:\vdvpj.exec:\vdvpj.exe99⤵
-
\??\c:\dvddd.exec:\dvddd.exe100⤵
-
\??\c:\fxrlflf.exec:\fxrlflf.exe101⤵
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe102⤵
-
\??\c:\tnhhbt.exec:\tnhhbt.exe103⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe104⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe105⤵
-
\??\c:\rflrlrf.exec:\rflrlrf.exe106⤵
-
\??\c:\tnhnhh.exec:\tnhnhh.exe107⤵
-
\??\c:\bhttnn.exec:\bhttnn.exe108⤵
-
\??\c:\7jpjp.exec:\7jpjp.exe109⤵
-
\??\c:\5ppjv.exec:\5ppjv.exe110⤵
-
\??\c:\fxxrffx.exec:\fxxrffx.exe111⤵
-
\??\c:\xfxrllf.exec:\xfxrllf.exe112⤵
-
\??\c:\bnbthn.exec:\bnbthn.exe113⤵
-
\??\c:\nnhbnb.exec:\nnhbnb.exe114⤵
-
\??\c:\jvvjp.exec:\jvvjp.exe115⤵
-
\??\c:\tbhthb.exec:\tbhthb.exe116⤵
-
\??\c:\thtnnh.exec:\thtnnh.exe117⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe118⤵
-
\??\c:\1lrlrlr.exec:\1lrlrlr.exe119⤵
-
\??\c:\7rxrffr.exec:\7rxrffr.exe120⤵
-
\??\c:\tthttt.exec:\tthttt.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-