Malware Analysis Report

2024-11-16 14:20

Sample ID 240620-2j96ta1apf
Target 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe
SHA256 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986
Tags
blackmoon banker trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986

Threat Level: Known bad

The file 17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

blackmoon banker trojan

Blackmoon family

Detect Blackmoon payload

Blackmoon, KrBanker

Deletes itself

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 22:37

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 22:37

Reported

2024-06-20 22:40

Platform

win7-20240508-en

Max time kernel

148s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemderos.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Systemderos.exe

"C:\Users\Admin\AppData\Local\Temp\Systemderos.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 i2.tietuku.com udp

Files

\Users\Admin\AppData\Local\Temp\Systemderos.exe

MD5 f73b114ec2d054b6625e5ff12e59cd2c
SHA1 b578448471f9fe626c0278b91b3a879800a8a39f
SHA256 1995fe9e8af0c1777787421f1a881b842ab1ad29f734292be40a3c5c751f140d
SHA512 3b75e5025932e1ce3ae4f7e0419500e81d0141c9c4d6a89f3150b99d3ffd38fa5e9f1d20eabab401cb683668717d826e0cf39874ffb4ff2ab751c62094e9397e

C:\Users\Admin\AppData\Local\Temp\path.ini

MD5 cad7102836f78ea7c6506d364bb1fb99
SHA1 911dd95e71d3f4bcb243413462013592ee75e33e
SHA256 6d0fa215f7cfc236389e3edc3721847ad487342bb23c562805f4646a54fb5f7c
SHA512 1ff3d948fb930843df86886022f00c5e29f208ebb0d27f611a046c32c9c6e17a86961938e6866529b31df6b58f176ad916a4c6a73dd55a96373f08aee8763e01

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 22:37

Reported

2024-06-20 22:40

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\17d942e6dbe0bca3f1471315b4bb9619b210bd3b9ac29cbf045575e127029986_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe

"C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 i2.tietuku.com udp

Files

C:\Users\Admin\AppData\Local\Temp\Systemdchbz.exe

MD5 6cf04f157c3217cb9a62bdd792dd736d
SHA1 a8cd516dad2e7c38ee724a89fe578dbd5c3c5214
SHA256 cf435e6774c65669b787c3dfa133a5b8c47c638190b64d6eb9c36daed23e64b6
SHA512 ba8dee341ac3fa06d1ca88b3e0570475f6ccaf833298b9de00128da1ff020aa4dab1056dde094035db745ed5a0f15f788b3ed1440200254fbee7a4d47df37be7

C:\Users\Admin\AppData\Local\Temp\path.ini

MD5 cad7102836f78ea7c6506d364bb1fb99
SHA1 911dd95e71d3f4bcb243413462013592ee75e33e
SHA256 6d0fa215f7cfc236389e3edc3721847ad487342bb23c562805f4646a54fb5f7c
SHA512 1ff3d948fb930843df86886022f00c5e29f208ebb0d27f611a046c32c9c6e17a86961938e6866529b31df6b58f176ad916a4c6a73dd55a96373f08aee8763e01