Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe
-
Size
2.9MB
-
MD5
1c809b8af5e20b5520a072773ffbba70
-
SHA1
1bb4fb0dab86b12c55171385ddfea2d7e92a997d
-
SHA256
a8b7a61705337984b4c4d54d94dbe587e8839baa2b352eca2e9fa8e7574133f6
-
SHA512
12dcee893244b014d09a719680e55dc82bddfc807cd147773d2e51d1683022c8a9d081fe00a1e3475ac6023445180cbed8a970471994ef1550ee520692b4aba8
-
SSDEEP
49152:4ce7KpA6vXpoJ3kBCCjqUeGZHMIo1pqz40oBzv5bPknvr62tuLCG6T:4c26fCC/PMIi4oDgnDFteCGY
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1704-4-0x0000000003250000-0x0000000003273000-memory.dmp family_blackmoon behavioral2/memory/1704-2-0x0000000003250000-0x0000000003273000-memory.dmp family_blackmoon behavioral2/memory/1704-11-0x0000000003250000-0x0000000003273000-memory.dmp family_blackmoon -
Processes:
resource yara_rule behavioral2/memory/1704-4-0x0000000003250000-0x0000000003273000-memory.dmp upx behavioral2/memory/1704-2-0x0000000003250000-0x0000000003273000-memory.dmp upx behavioral2/memory/1704-7-0x0000000003280000-0x000000000328B000-memory.dmp upx behavioral2/memory/1704-11-0x0000000003250000-0x0000000003273000-memory.dmp upx -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exepid process 1704 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe 1704 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe 1704 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.execmd.exedescription pid process target process PID 1704 wrote to memory of 1472 1704 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe cmd.exe PID 1704 wrote to memory of 1472 1704 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe cmd.exe PID 1704 wrote to memory of 1472 1704 1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe cmd.exe PID 1472 wrote to memory of 3612 1472 cmd.exe PING.EXE PID 1472 wrote to memory of 3612 1472 cmd.exe PING.EXE PID 1472 wrote to memory of 3612 1472 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 1.1.1.1 -n 1 -w 100 & del "C:\Users\Admin\AppData\Local\Temp\1c809b8af5e20b5520a072773ffbba70_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 1003⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1704-0-0x0000000000400000-0x0000000000A41000-memory.dmpFilesize
6.3MB
-
memory/1704-1-0x0000000002950000-0x0000000002977000-memory.dmpFilesize
156KB
-
memory/1704-4-0x0000000003250000-0x0000000003273000-memory.dmpFilesize
140KB
-
memory/1704-6-0x0000000075350000-0x0000000075440000-memory.dmpFilesize
960KB
-
memory/1704-5-0x000000007536F000-0x0000000075370000-memory.dmpFilesize
4KB
-
memory/1704-3-0x0000000010000000-0x0000000010016000-memory.dmpFilesize
88KB
-
memory/1704-2-0x0000000003250000-0x0000000003273000-memory.dmpFilesize
140KB
-
memory/1704-8-0x0000000075350000-0x0000000075440000-memory.dmpFilesize
960KB
-
memory/1704-9-0x0000000075350000-0x0000000075440000-memory.dmpFilesize
960KB
-
memory/1704-7-0x0000000003280000-0x000000000328B000-memory.dmpFilesize
44KB
-
memory/1704-10-0x0000000000400000-0x0000000000A41000-memory.dmpFilesize
6.3MB
-
memory/1704-11-0x0000000003250000-0x0000000003273000-memory.dmpFilesize
140KB
-
memory/1704-12-0x0000000075350000-0x0000000075440000-memory.dmpFilesize
960KB