Analysis
- max time kernel
148s - max time network
122s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
20/06/2024, 23:47
Behavioral task
behavioral1
Sample
1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
General
- Target 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe
- Size 87KB
- Sample240620-3tapdaxbkr
- SHA256 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36
- MD5 8135c81a0fe3165a6d1b9191b785c970
- SHA1 cced56cf6536bdcabb14cbb79451dd289a3693bc
- SHA512 f27030f70f62d864888032c9c80961802fa544a59e0a59a101ebae3205469394c1918b176ed72f84113028741595725d85b1841986a0a8c5798ac32d18935eb3
- SSDEEP 1536:D3ScSeuCQ5CvP3ErbK0GsA1Irn6ykkXERklFceLnFaswUemjmh5WGiirTb9Qyzq:DSleucPUXKhsmIGZkXYUJFg5fRiaTRa
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral1/memory/2700-18-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon behavioral1/memory/2424-15-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon - Deletes itself 1 IoCs
pid Process 2700 Systemufvsq.exe - Executes dropped EXE 1 IoCs
pid Process 2700 Systemufvsq.exe - Loads dropped DLL 2 IoCs
pid Process 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2424-0-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/files/0x0007000000015f54-8.dat upx behavioral1/memory/2700-18-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/memory/2424-15-0x0000000000400000-0x000000000047E000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe 2700 Systemufvsq.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2700 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 29 PID 2424 wrote to memory of 2700 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 29 PID 2424 wrote to memory of 2700 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 29 PID 2424 wrote to memory of 2700 2424 1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f2775f52d529d64e3f4631d162bc16d57e4bc4712ae4f63020f6ce6b2fc7a36_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\Systemufvsq.exe"C:\Users\Admin\AppData\Local\Temp\Systemufvsq.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\path.ini
- Size 117B
- SHA256 c884dc93adef6cb80f776250a21aa19861b8026571c7294a27d25a4d96da497b
- MD5 7b5ad2581c44be434be491eda97f773c
- SHA1 6f52588585a61be07935183680fa3d4bbcb3afb7
- SHA512 cd0d959dbfb7764f5b21d1c21e4012d951df8fb66da6ecad99f8628962d5a47bbb26d9acc0de4580ad58bcca43fda0e33ad829f66e1c21014ed5c2d8d9d047c8
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\Systemufvsq.exe
- Size 87KB
- SHA256 003214b7c568c3d109a14c7a8149474448f15fc4bc507bb1a69b5f611a74f57a
- MD5 ff1f10f9160ac8151466d2e3f8ce77bb
- SHA1 eed72b0289c63dfe4faeb4a99f7b6327a6147df3
- SHA512 c4ff7a557ea2eeb58b1139152c6b377f1bd21d113450f736a91d890d14c24f29a821b2fa3733ec7f16ba0a9f60450a61bb4e9896c45e2b2ae71e71bfcfe48399
- SSDEEP 1536:D3ScSeuCQ5CvP3ErbK0GsA1Irn6ykkXERklFceLnFaswUemjmh5WGiirTb9QyzO:DSleucPUXKhsmIGZkXYUJFg5fRiaTRe
- MD5 SHA1 SHA512 SSDEEP