Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 02:18
Static task
static1
Behavioral task
behavioral1
Sample
89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe
-
Size
72KB
-
MD5
89b47239b2ef995da20227e74b617e90
-
SHA1
8d4a92c6a6c4923a8292020e577bbe5bb5396a47
-
SHA256
36e03cddbae1a81757b830ebc3c735037d473e829235f522c2e4f677d20ecc8d
-
SHA512
6c5e9b9b9b993856c1280bc7e4d9c8ddad6da2b5eecff9793e767fc18aef9d8ecea74e117b8f60ecb869a333eb1c874c4136b8c5bc0c3ab5729bd82c254e5434
-
SSDEEP
1536:wLXB65939tY6HBg4sXJKxIjVlWmBX6CCtl8S8qcy4rLnV0:wLk395hYXJK+KpCC/8jy4fn6
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 2272 PogoGamesSetup.exe 2824 InstGameInfoHelperPDGC.exe -
Loads dropped DLL 7 IoCs
pid Process 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 2272 PogoGamesSetup.exe 2272 PogoGamesSetup.exe 2272 PogoGamesSetup.exe 2272 PogoGamesSetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0007000000016d45-12.dat nsis_installer_1 behavioral1/files/0x0007000000016d45-12.dat nsis_installer_2 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2272 PogoGamesSetup.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2272 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 2272 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 2272 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 2272 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 2272 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 2272 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 2272 3056 89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe 28 PID 2272 wrote to memory of 2824 2272 PogoGamesSetup.exe 29 PID 2272 wrote to memory of 2824 2272 PogoGamesSetup.exe 29 PID 2272 wrote to memory of 2824 2272 PogoGamesSetup.exe 29 PID 2272 wrote to memory of 2824 2272 PogoGamesSetup.exe 29 PID 2272 wrote to memory of 2824 2272 PogoGamesSetup.exe 29 PID 2272 wrote to memory of 2824 2272 PogoGamesSetup.exe 29 PID 2272 wrote to memory of 2824 2272 PogoGamesSetup.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\nst252E.tmp\PogoGamesSetup.exeC:\Users\Admin\AppData\Local\Temp\nst252E.tmp\PogoGamesSetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\nst4A5A.tmp\InstGameInfoHelperPDGC.exe"C:\Users\Admin\AppData\Local\Temp\nst4A5A.tmp\InstGameInfoHelperPDGC.exe"3⤵
- Executes dropped EXE
PID:2824
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5f2ef27ff5ef36a0b4efb2618dbda8355
SHA10a6714e922f3a87527fd3f71fd842c98e68405ec
SHA2561f829f0c26c019bc9778289ab0b16378ae7323f09e6ea621e1eb98b3f9686080
SHA512ce227b576e8c75c0e6784e7d81b7fe0ad76f69b712a6cf036bf723dc6f176bc3e4ce77d016c80d12b08c034140a1d7dd268c5e7c0ee784d8bcb004cd1a08e65a
-
Filesize
439KB
MD5697f994b0b2f77418f4ff7c479b2b419
SHA19891834f745d30b73d22180a845289ad94c3a812
SHA2569c2b9dbe13d6f8901d7609d4a3e2e292e964ad76fcb57a61a16ecea6f86b7513
SHA5124339ea4daa31d73507bb776254ec9fbca6204ef8ebe7e5f03f6d9ffa3e48bf2544ca98984d12232c70180ab685fc9945bb6e7b6559d6c837773dc8643d0e6e0d
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
45.6MB
MD536005a637bb8ec75ada6b8c18a36d824
SHA1705df461833c7d3782e035a465e98736be4bc801
SHA2564ee6bf01aadb0bc90bfce6e80862e20886338dc71114794384d874733873b444
SHA512f4242a85f8d3204a8cc3acab46df3161d5045ecab2f15a694506fd9aa0603f74f2748fb96ad40df7f793e45795c7fb506b5c988476607a8227a29ce226c6248c
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
4KB
MD555788069d3fa4e1daf80f3339fa86fe2
SHA1d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96
SHA256d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f
SHA512d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe