Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe
Resource
win7-20240220-en
7 signatures
150 seconds
General
-
Target
1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe
-
Size
2.9MB
-
MD5
1c809b8af5e20b5520a072773ffbba70
-
SHA1
1bb4fb0dab86b12c55171385ddfea2d7e92a997d
-
SHA256
a8b7a61705337984b4c4d54d94dbe587e8839baa2b352eca2e9fa8e7574133f6
-
SHA512
12dcee893244b014d09a719680e55dc82bddfc807cd147773d2e51d1683022c8a9d081fe00a1e3475ac6023445180cbed8a970471994ef1550ee520692b4aba8
-
SSDEEP
49152:4ce7KpA6vXpoJ3kBCCjqUeGZHMIo1pqz40oBzv5bPknvr62tuLCG6T:4c26fCC/PMIi4oDgnDFteCGY
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2768-1-0x0000000000300000-0x0000000000323000-memory.dmp family_blackmoon behavioral1/memory/2768-3-0x0000000000300000-0x0000000000323000-memory.dmp family_blackmoon behavioral1/memory/2768-10-0x0000000000300000-0x0000000000323000-memory.dmp family_blackmoon -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2576 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/2768-1-0x0000000000300000-0x0000000000323000-memory.dmp upx behavioral1/memory/2768-3-0x0000000000300000-0x0000000000323000-memory.dmp upx behavioral1/memory/2768-6-0x0000000000B50000-0x0000000000B5B000-memory.dmp upx behavioral1/memory/2768-10-0x0000000000300000-0x0000000000323000-memory.dmp upx -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exepid process 2768 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe 2768 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe 2768 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.execmd.exedescription pid process target process PID 2768 wrote to memory of 2576 2768 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe cmd.exe PID 2768 wrote to memory of 2576 2768 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe cmd.exe PID 2768 wrote to memory of 2576 2768 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe cmd.exe PID 2768 wrote to memory of 2576 2768 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe cmd.exe PID 2576 wrote to memory of 2220 2576 cmd.exe PING.EXE PID 2576 wrote to memory of 2220 2576 cmd.exe PING.EXE PID 2576 wrote to memory of 2220 2576 cmd.exe PING.EXE PID 2576 wrote to memory of 2220 2576 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 1.1.1.1 -n 1 -w 100 & del "C:\Users\Admin\AppData\Local\Temp\1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 1003⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2768-0-0x0000000000400000-0x0000000000A41000-memory.dmpFilesize
6.3MB
-
memory/2768-1-0x0000000000300000-0x0000000000323000-memory.dmpFilesize
140KB
-
memory/2768-2-0x0000000010000000-0x0000000010016000-memory.dmpFilesize
88KB
-
memory/2768-4-0x0000000075C41000-0x0000000075C42000-memory.dmpFilesize
4KB
-
memory/2768-3-0x0000000000300000-0x0000000000323000-memory.dmpFilesize
140KB
-
memory/2768-5-0x0000000075C30000-0x0000000075D40000-memory.dmpFilesize
1.1MB
-
memory/2768-6-0x0000000000B50000-0x0000000000B5B000-memory.dmpFilesize
44KB
-
memory/2768-7-0x0000000075C30000-0x0000000075D40000-memory.dmpFilesize
1.1MB
-
memory/2768-8-0x0000000000400000-0x0000000000A41000-memory.dmpFilesize
6.3MB
-
memory/2768-9-0x0000000075C30000-0x0000000075D40000-memory.dmpFilesize
1.1MB
-
memory/2768-10-0x0000000000300000-0x0000000000323000-memory.dmpFilesize
140KB