Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
21/06/2024, 04:30
Behavioral task
behavioral1
Sample
3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
General
- Target 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe
- Size 431KB
- Sample240621-e4yl7asckq
- SHA256 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7
- MD5 958d1b88d6e33021458a2f1b47d383b0
- SHA1 bd9ff9b24f1955c73bb2dd3d3bbdf47a5eb13b1d
- SHA512 2beb4ee9f743c566e02c3074c5a8b8cd04da8b3a0c980893f84415dcb105e25db09080419d53a57e45dbca867310b19b5e8e554afe42ecc6ae96a1a8aae6ea78
- SSDEEP 6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAO:c4Fm3b7yOAHNar4mUf9lJ82scqAO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023419-8.dat family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe - Deletes itself 1 IoCs
pid Process 1584 Systemtkrwu.exe - Executes dropped EXE 1 IoCs
pid Process 1584 Systemtkrwu.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe 1584 Systemtkrwu.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3772 wrote to memory of 1584 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 85 PID 3772 wrote to memory of 1584 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 85 PID 3772 wrote to memory of 1584 3772 3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3c68ee71a6ed72c64b866c5dbea8d235c34cf2d03695ed88097916fb844d18c7_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\Systemtkrwu.exe"C:\Users\Admin\AppData\Local\Temp\Systemtkrwu.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Systemtkrwu.exe
- Size 431KB
- SHA256 782507bf6508f12019957f759af1ff0066088cd964cb7e48923bd711b5e0f8ab
- MD5 9f8c02e1cc25e1e437d36ee96cf1de31
- SHA1 e9993aa6ca2753162306776adf8ffa12771831d9
- SHA512 bdaf1b8d1bdeb751dc8b809ded8633ffa7bda97a3827606f0586ad47784f37c28bc4ef2fd1be952d9b010949657353a180917f3e2fb9268913b41c30c09c4d3d
- SSDEEP 6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqA0:c4Fm3b7yOAHNar4mUf9lJ82scqA0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\path.ini
- Size 117B
- SHA256 1ab620a9bc3645fc6c400712a8437c264a53956599089e1d30b155ecfa853f21
- MD5 39a6ad471d41bfb9cb334d5abfcb759b
- SHA1 f11f37039c94dc6b041c150d2fa0b9bb562a2954
- SHA512 5d28ec0c46c8b547c896ba443d9ed201bbb00456226671feba95b841cd56b272eb01ec8a4c3849235283e777d8d5c5d68dc407178446269bbf58f0f600a85af7
- MD5 SHA1 SHA512