Analysis
- max time kernel
149s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 07:00
Behavioral task
behavioral1
Sample
5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
General
- Target 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe
- Size 89KB
- Sample240617-hsshkszalc
- SHA256 a6934f855dff01139548d5f61543006054bd86daeb60df931d1773a288ab5e42
- MD5 5dfb12a419b89430d3972bf32f6ef770
- SHA1 8dc022c3eca2709f8263cacbccdfa040d4edd6b4
- SHA512 113d63c7c44392de29c8292f6c6da41660545dede2d2ca02fbcb8423cb2336990cf379052376d422d47169aaa9a4eeaf61bc3987a3fe92a0910a4a51a69acaae
- SSDEEP 1536:5+4hkM3Yz8wMZhUD2XsjEQWOSkE+Ct6WKBex3GWU5FkWp+AmQwKGSZhCQbIo/tSK:dq6OLM3QasY5Ft71fqWWp+efG4hCQrX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/3464-14-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon behavioral2/memory/2544-16-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe - Deletes itself 1 IoCs
pid Process 2544 Syslemhpumx.exe - Executes dropped EXE 1 IoCs
pid Process 2544 Syslemhpumx.exe -
resource yara_rule behavioral2/memory/3464-0-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/files/0x000b00000002340f-9.dat upx behavioral2/memory/3464-14-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/2544-16-0x0000000000400000-0x000000000047F000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe 2544 Syslemhpumx.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3464 wrote to memory of 2544 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 84 PID 3464 wrote to memory of 2544 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 84 PID 3464 wrote to memory of 2544 3464 5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5dfb12a419b89430d3972bf32f6ef770_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\Syslemhpumx.exe"C:\Users\Admin\AppData\Local\Temp\Syslemhpumx.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Syslemhpumx.exe
- Size 89KB
- SHA256 01b5e8ea10ef34ae43631ae5da4a4ddf9e9861ac0a00d13fcb441ab542f14ee1
- MD5 471ab3af0152536d1d9301a97a02386e
- SHA1 85aaac299633ea42d302c7c33e1b68af58d8f6f4
- SHA512 db6920f9a9a483784f92c16991c5eeac0f2a6aa3510bd17ac8f0acc6c9bcda46ea6e725594b388da1b94b6fd797209d68095f26866298414d8bdf75d92fb7ed9
- SSDEEP 1536:5+4hkM3Yz8wMZhUD2XsjEQWOSkE+Ct6WKBex3GWU5FkWp+AmQwKGSZhCQbIo/tS1:dq6OLM3QasY5Ft71fqWWp+efG4hCQrW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\lpath.ini
- Size 85B
- SHA256 485febf73cc1e25045eca07091757fc50c4af488d038e5bda6e0f65035696d4e
- MD5 762a314487d7cf50f71a6c759e2cff79
- SHA1 03d34223b5c3516bec2011bf9c63296bf33c40ec
- SHA512 a8abff688cd7d16c0c76b1e819b0ce7982e30239fea046f8f4358c41561aa7d4f9981fbf005f1f50f926fd18c0621d449d070c652dc4b97c44e3adaab038bf7d
- MD5 SHA1 SHA512