Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 23:26
Behavioral task
behavioral1
Sample
76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
General
- Target 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe
- Size 87KB
- Sample240607-3e1x1seh82
- SHA256 c016f38a29056e55d0d574fd525af9a3726ccccfc4fec4fe36a831929ff0863b
- MD5 76dae2a463697e7c13a8cec7026ed5f0
- SHA1 281eb3f7bd9440fa6e8c3c1ceb5247468279339e
- SHA512 c084400ca9a6955d11d7fad98903626d163f9a702e9d230a2c66b9d6ea786340d259ee639e409e3aed9c7b524666f5c441f8286432c58a30edfe8a72676d3ac1
- SSDEEP 1536:Lxos1lS77S/87BJM2pThWf9DcqZmR8/bMxnONDjYseXPmo06/i/XdVw/iB:jjfbcRkbMVu7EqQ/e
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/4412-15-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon behavioral2/memory/4676-17-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe - Deletes itself 1 IoCs
pid Process 4676 Systemrmsmf.exe - Executes dropped EXE 1 IoCs
pid Process 4676 Systemrmsmf.exe -
resource yara_rule behavioral2/memory/4412-0-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/files/0x000500000001e3a4-9.dat upx behavioral2/memory/4676-14-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/memory/4412-15-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/memory/4676-17-0x0000000000400000-0x000000000047E000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe 4676 Systemrmsmf.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4676 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 89 PID 4412 wrote to memory of 4676 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 89 PID 4412 wrote to memory of 4676 4412 76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\76dae2a463697e7c13a8cec7026ed5f0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\Systemrmsmf.exe"C:\Users\Admin\AppData\Local\Temp\Systemrmsmf.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Systemrmsmf.exe
- Size 87KB
- SHA256 91a883c978e25260de4f2c08be059155a9d529cb6587b46ddbd080f1fbd63728
- MD5 f59130f9a0af91d0be852cb8b05fdeb4
- SHA1 e8d67922533e8525bedade3bb8c70dbf2e757166
- SHA512 ebf2bd380f4215a082c81a57626894126bfb146c2ef8e7d61f808d4aca8dace70edf2a8d8b88f2b470916ab3a642f72dfb6e7a0b3db19c0bd78dc73635ba8efc
- SSDEEP 1536:Lxos1lS77S/87BJM2pThWf9DcqZmR8/bMxnONDjYseXPmo06/i/XdVw/iR:jjfbcRkbMVu7EqQ/A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\path.ini
- Size 85B
- SHA256 51e9821f4f9a290a18795e1a4ed9cc292bc21d13172aeeb74ea29151d84208cb
- MD5 b5ecc8a3698a702f0cbe4dc33d9eaec3
- SHA1 4de8ad2b1a08f461eecadb217d25b640fdf65f7a
- SHA512 3e771bac0d3b785b97fa90647c7e1c6b4c7b7a04cbfaf0b3ef216af8a6ff2715f14a9425bb8c9af9433d8427b40ddb7458abadb2c83ec92d28102ed60835655f
- MD5 SHA1 SHA512