Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    01-06-2024 02:18

General

  • Target

    89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe

  • Size

    72KB

  • MD5

    89b47239b2ef995da20227e74b617e90

  • SHA1

    8d4a92c6a6c4923a8292020e577bbe5bb5396a47

  • SHA256

    36e03cddbae1a81757b830ebc3c735037d473e829235f522c2e4f677d20ecc8d

  • SHA512

    6c5e9b9b9b993856c1280bc7e4d9c8ddad6da2b5eecff9793e767fc18aef9d8ecea74e117b8f60ecb869a333eb1c874c4136b8c5bc0c3ab5729bd82c254e5434

  • SSDEEP

    1536:wLXB65939tY6HBg4sXJKxIjVlWmBX6CCtl8S8qcy4rLnV0:wLk395hYXJK+KpCC/8jy4fn6

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\89b47239b2ef995da20227e74b617e90_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Local\Temp\nst252E.tmp\PogoGamesSetup.exe
      C:\Users\Admin\AppData\Local\Temp\nst252E.tmp\PogoGamesSetup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Users\Admin\AppData\Local\Temp\nst4A5A.tmp\InstGameInfoHelperPDGC.exe
        "C:\Users\Admin\AppData\Local\Temp\nst4A5A.tmp\InstGameInfoHelperPDGC.exe"
        3⤵
        • Executes dropped EXE
        PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst252E.tmp\ftdownload.dat

    Filesize

    512B

    MD5

    f2ef27ff5ef36a0b4efb2618dbda8355

    SHA1

    0a6714e922f3a87527fd3f71fd842c98e68405ec

    SHA256

    1f829f0c26c019bc9778289ab0b16378ae7323f09e6ea621e1eb98b3f9686080

    SHA512

    ce227b576e8c75c0e6784e7d81b7fe0ad76f69b712a6cf036bf723dc6f176bc3e4ce77d016c80d12b08c034140a1d7dd268c5e7c0ee784d8bcb004cd1a08e65a

  • C:\Users\Admin\AppData\Local\Temp\nst4A5A.tmp\InstGameInfoHelperPDGC.exe

    Filesize

    439KB

    MD5

    697f994b0b2f77418f4ff7c479b2b419

    SHA1

    9891834f745d30b73d22180a845289ad94c3a812

    SHA256

    9c2b9dbe13d6f8901d7609d4a3e2e292e964ad76fcb57a61a16ecea6f86b7513

    SHA512

    4339ea4daa31d73507bb776254ec9fbca6204ef8ebe7e5f03f6d9ffa3e48bf2544ca98984d12232c70180ab685fc9945bb6e7b6559d6c837773dc8643d0e6e0d

  • \Users\Admin\AppData\Local\Temp\nst252E.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nst252E.tmp\PogoGamesSetup.exe

    Filesize

    45.6MB

    MD5

    36005a637bb8ec75ada6b8c18a36d824

    SHA1

    705df461833c7d3782e035a465e98736be4bc801

    SHA256

    4ee6bf01aadb0bc90bfce6e80862e20886338dc71114794384d874733873b444

    SHA512

    f4242a85f8d3204a8cc3acab46df3161d5045ecab2f15a694506fd9aa0603f74f2748fb96ad40df7f793e45795c7fb506b5c988476607a8227a29ce226c6248c

  • \Users\Admin\AppData\Local\Temp\nst252E.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • \Users\Admin\AppData\Local\Temp\nst4A5A.tmp\ButtonEvent.dll

    Filesize

    4KB

    MD5

    55788069d3fa4e1daf80f3339fa86fe2

    SHA1

    d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96

    SHA256

    d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f

    SHA512

    d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616

  • \Users\Admin\AppData\Local\Temp\nst4A5A.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    acc2b699edfea5bf5aae45aba3a41e96

    SHA1

    d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    SHA256

    168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    SHA512

    e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe