Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2024, 22:37
Behavioral task
behavioral1
Sample
17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
General
- Target 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe
- Size 431KB
- Sample240620-2j96ta1apf
- SHA256 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986
- MD5 f0a0e8906c023da76ad2a5f44f4d8680
- SHA1 c6bfd903690f5661dd8434d1e23ece4e3d703815
- SHA512 c96e7ce746bf89d3a28b81b175c5dba068260ae636fa6d5f1caec4677689deb9e58e5c9cfdef407451b4f5141bb33fb61dd68d53cad05780835efcf12f693aa9
- SSDEEP 3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKU/:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+w
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023423-8.dat family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe - Deletes itself 1 IoCs
pid Process 3280 Systemdchbz.exe - Executes dropped EXE 1 IoCs
pid Process 3280 Systemdchbz.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe 3280 Systemdchbz.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5052 wrote to memory of 3280 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 86 PID 5052 wrote to memory of 3280 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 86 PID 5052 wrote to memory of 3280 5052 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe"C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3280
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe
- Size 431KB
- SHA256 cf435e6774c65669b787c3dfa133a5b8c47c638190b64d6eb9c36daed23e64b6
- MD5 6cf04f157c3217cb9a62bdd792dd736d
- SHA1 a8cd516dad2e7c38ee724a89fe578dbd5c3c5214
- SHA512 ba8dee341ac3fa06d1ca88b3e0570475f6ccaf833298b9de00128da1ff020aa4dab1056dde094035db745ed5a0f15f788b3ed1440200254fbee7a4d47df37be7
- SSDEEP 3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUN:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\path.ini
- Size 117B
- SHA256 6d0fa215f7cfc236389e3edc3721847ad487342bb23c562805f4646a54fb5f7c
- MD5 cad7102836f78ea7c6506d364bb1fb99
- SHA1 911dd95e71d3f4bcb243413462013592ee75e33e
- SHA512 1ff3d948fb930843df86886022f00c5e29f208ebb0d27f611a046c32c9c6e17a86961938e6866529b31df6b58f176ad916a4c6a73dd55a96373f08aee8763e01
- MD5 SHA1 SHA512