Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 13:38
Behavioral task
behavioral1
Sample
72474510b8702975568960f211dec250_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
- Target 72474510b8702975568960f211dec250_NeikiAnalytics.exe
- Size 87KB
- Sample240607-qxefhsgh81
- SHA256 6a8daf5b825db14cff71e6289d372cb362893a4c835bef75d2de0ab6f3a5353e
- MD5 72474510b8702975568960f211dec250
- SHA1 5d27b4837395607cfc46e5eb9ad9cfd44697c524
- SHA512 0ac1676764d8d261ffa6dd29b2912e0e0fe36f2fa33392999902a3e2b6b35a6972aaf5608404a009c3d1b2cd1b9013b78acd1bf3819479a3254d5f7a6c7806fd
- SSDEEP 1536:Lxos1lS77S/87BJM2pThWf9DcqZmR8/bMxnONDjYseXPmo06/i/XdVw/iT:jjfbcRkbMVu7EqQ/a
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/3460-15-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon behavioral2/memory/2600-17-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 72474510b8702975568960f211dec250_NeikiAnalytics.exe - Deletes itself 1 IoCs
pid Process 2600 Systemalekf.exe - Executes dropped EXE 1 IoCs
pid Process 2600 Systemalekf.exe -
resource yara_rule behavioral2/memory/3460-0-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/files/0x000a00000000002f-9.dat upx behavioral2/memory/2600-14-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/memory/3460-15-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/memory/2600-17-0x0000000000400000-0x000000000047E000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe 2600 Systemalekf.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3460 wrote to memory of 2600 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 100 PID 3460 wrote to memory of 2600 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 100 PID 3460 wrote to memory of 2600 3460 72474510b8702975568960f211dec250_NeikiAnalytics.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\72474510b8702975568960f211dec250_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\72474510b8702975568960f211dec250_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\Systemalekf.exe"C:\Users\Admin\AppData\Local\Temp\Systemalekf.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:81⤵PID:3228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Systemalekf.exe
- Size 87KB
- SHA256 c45894bfe5e16bd54022c7b6404884ac0d3091226968d21dc12a3f1856402b14
- MD5 3071eaea93c0fbe5219aee22323dcf1a
- SHA1 07810fdcbe23b9a2eee95ab93a3b7f5af9e9743b
- SHA512 f7c3d21c457a5b9d7fd77487c45b2e6ec8797b4704cd505809130a95b62f8d4364be3e0bdd628a3cdeae8ab5497103229965c0168ad262953b91c2bed0611e59
- SSDEEP 1536:Lxos1lS77S/87BJM2pThWf9DcqZmR8/bMxnONDjYseXPmo06/i/XdVw/ij:jjfbcRkbMVu7EqQ/g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\path.ini
- Size 85B
- SHA256 efa1d7c4bf2954c235ccbab850e92d69f9dd4997fb7386b04c67a921f57bec4d
- MD5 8e99842203917ec86e70993425e558a2
- SHA1 dd07339916e7282cded9c195e98162cc8199581f
- SHA512 93b0ef015cd838bc2267cc37da51cf852ab66534563a4bc023dfcbf71ef5335430a81ef8dd2358e5a79833b740dfffb1e8682456ca067b8512bb7cbfb59cf24c
- MD5 SHA1 SHA512