dcrat | 54407f425416b36b90fb26b1ed72a9126dd7e4e6ff833cd9bb1b0f77d31b160d

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Size 2.0MB
Sample240510-wm9fssdc57
SHA256 54407f425416b36b90fb26b1ed72a9126dd7e4e6ff833cd9bb1b0f77d31b160d
MD5 3b1fc3c26c0b389300f97131887434f0
SHA1 7e8d16c3c5b89f965e4c9224aefc292ee9e95abe
SHA512 69ab56dc54c2cbb59b56e2b39b48958e3b7b5fb125aab6f019b121cbc24b5f2ae41d77f41127aa25f8b4cb55970d5fd560105d6e86c0672e642547a7e9ed0219
SSDEEP 24576:kn2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:SaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 47 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4224	schtasks.exe
		4776	schtasks.exe
		1588	schtasks.exe
		4660	schtasks.exe
		1668	schtasks.exe
		4900	schtasks.exe
		4580	schtasks.exe
		4264	schtasks.exe
		4216	schtasks.exe
		384	schtasks.exe
		4100	schtasks.exe
		2560	schtasks.exe
		3912	schtasks.exe
		772	schtasks.exe
		2136	schtasks.exe
		4512	schtasks.exe
		3792	schtasks.exe
		2144	schtasks.exe
		2188	schtasks.exe
		3756	schtasks.exe
File created	C:\Windows\CbsTemp\6c7ec5908fd907		3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
		4828	schtasks.exe
		4220	schtasks.exe
		2928	schtasks.exe
		1836	schtasks.exe
		3508	schtasks.exe
		4508	schtasks.exe
		532	schtasks.exe
		672	schtasks.exe
		4924	schtasks.exe
		3156	schtasks.exe
		3564	schtasks.exe
		3528	schtasks.exe
		1312	schtasks.exe
		3132	schtasks.exe
		1340	schtasks.exe
		3472	schtasks.exe
		3708	schtasks.exe
		3560	schtasks.exe
		2636	schtasks.exe
		1924	schtasks.exe
		2096	schtasks.exe
		1164	schtasks.exe
		4116	schtasks.exe
		4412	schtasks.exe
File created	C:\Windows\CbsTemp\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe		3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
		4540	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	2596	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	2596	schtasks.exe	91

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1044-1-0x0000000000560000-0x000000000076C000-memory.dmp	dcrat
behavioral2/files/0x0007000000023552-23.dat	dcrat
behavioral2/files/0x000800000002296f-106.dat	dcrat
behavioral2/files/0x00100000000232e2-152.dat	dcrat
behavioral2/files/0x000a0000000232ff-163.dat	dcrat
behavioral2/files/0x0009000000023300-174.dat	dcrat
behavioral2/files/0x000b000000023302-207.dat	dcrat
behavioral2/files/0x000b000000023303-220.dat	dcrat
behavioral2/memory/3720-283-0x0000000000F90000-0x000000000119C000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3720	services.exe

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Recovery\\WindowsRE\\msedge.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics = "\"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Registration\\CRMLog\\System.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\MSBuild\\RuntimeBroker.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Windows Defender\\es-ES\\sysmon.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\sppsvc.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Windows Defender\\es-ES\\sysmon.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Portable Devices\\System.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\addins\\csrss.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\MSBuild\\RuntimeBroker.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Recovery\\WindowsRE\\msedge.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\addins\\csrss.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\sppsvc.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Registration\\CRMLog\\System.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics = "\"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Portable Devices\\System.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\es-ES\sysmon.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\RCXFF61.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\StartMenuExperienceHost.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Portable Devices\System.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Program Files\MSBuild\RuntimeBroker.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXF15C.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\StartMenuExperienceHost.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX757.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\MSBuild\RCXBEF.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\55b276f4edf653	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Portable Devices\27d1bcfc3c54e0	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Program Files\MSBuild\9e8d7a4ca61bd9	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXF13C.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX756.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\MSBuild\RCXB81.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\121e5b5079f7c0	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\RCXFFD0.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\sysmon.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\System.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\MSBuild\RuntimeBroker.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\en-US\0a1fd5f707cd16	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\eddb19405b7ce1	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\CbsTemp\RCXED11.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Microsoft.NET\RCXF8B4.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\backgroundTaskHost.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Windows\Registration\CRMLog\27d1bcfc3c54e0	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCXEF27.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Windows\addins\csrss.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCXEF28.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Registration\CRMLog\System.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\addins\csrss.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Windows\DigitalLocker\en-US\sppsvc.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Windows\CbsTemp\6c7ec5908fd907	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Microsoft.NET\RCXF8B5.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Microsoft.NET\backgroundTaskHost.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\addins\RCX96C.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\CbsTemp\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCXFAC9.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Windows\CbsTemp\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Windows\Registration\CRMLog\System.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\addins\RCX96D.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File created	C:\Windows\addins\886983d96e3d3e	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\CbsTemp\RCXED22.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\sppsvc.exe	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCXFACA.tmp	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1588	schtasks.exe
532	schtasks.exe
1164	schtasks.exe
1924	schtasks.exe
4512	schtasks.exe
4776	schtasks.exe
4580	schtasks.exe
2636	schtasks.exe
3132	schtasks.exe
2096	schtasks.exe
1312	schtasks.exe
2144	schtasks.exe
772	schtasks.exe
3756	schtasks.exe
4412	schtasks.exe
3708	schtasks.exe
1340	schtasks.exe
2136	schtasks.exe
672	schtasks.exe
2928	schtasks.exe
4924	schtasks.exe
4220	schtasks.exe
2560	schtasks.exe
2188	schtasks.exe
4264	schtasks.exe
3560	schtasks.exe
4116	schtasks.exe
1836	schtasks.exe
4900	schtasks.exe
4660	schtasks.exe
3156	schtasks.exe
3472	schtasks.exe
4540	schtasks.exe
4216	schtasks.exe
3564	schtasks.exe
4100	schtasks.exe
4828	schtasks.exe
3508	schtasks.exe
3912	schtasks.exe
384	schtasks.exe
3528	schtasks.exe
1668	schtasks.exe
3792	schtasks.exe
4508	schtasks.exe
4224	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
3720	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3720	services.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3720	1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe	142
PID 1044 wrote to memory of 3720	1044	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Recovery\WindowsRE\services.exe
  "C:\Recovery\WindowsRE\services.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics3" /sc MINUTE /mo 12 /tr "'C:\Windows\CbsTemp\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics" /sc ONLOGON /tr "'C:\Windows\CbsTemp\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics3" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\DigitalLocker\en-US\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\DigitalLocker\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Windows\Microsoft.NET\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Windows\Microsoft.NET\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\addins\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\addins\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\MSBuild\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3128,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
1⤵
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmon.exe

Path C:\Program Files (x86)\Windows Defender\es-ES\sysmon.exe
Size 2.0MB
SHA256 bedd1ff047078898128610635f174e0db0364081447dfc0d4e6f4fcfb8597061
MD5 04874ce215637f92f5f2b1ee8f2f8362
SHA1 5632f3740dac50385eea49460f641a78ef67f50d
SHA512 af6209e388d5e761177b6b8595aa2cf5b7108586e71c1e4646d14ce9e9c7b8b0d0d150be3c46e35071e136ef928d98ceab7ceb937bd619a045badf7ded9f129a
SSDEEP 24576:En2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:yaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Program Files\MSBuild\RuntimeBroker.exe
Size 2.0MB
SHA256 7b2725ab90bb603d9c358ba5e85f7d10db427249be77e83a41d587fa049ce36f
MD5 a8a5476ef604d3da36d71b23df0e7ab6
SHA1 cf0a0ef4e5571eae4cdd373dbae5e77352389c2d
SHA512 b4033210ad48d046454ae1d02eada7f707d61ba0537ed1c4b55a882c13ed7d5d8a1cad12468d1270720ddafc130525f51976cc679ef8357f9879b5fb63ea2140
SSDEEP 24576:En2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:yaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Recovery\WindowsRE\msedge.exe
Size 2.0MB
SHA256 eecd0da7cc2773fcfbf21f991c84a2959b0f3c040939eca1de56c8c2d4799b38
MD5 b724e5922a25208bf769ae3c852edd0b
SHA1 5001765d83a4a8ab05ce324690d3cb2936357149
SHA512 d454f322e47ee59c8df4e222c4db24d90513c67b0ce80864a65f3534f7c81b95f87fe0bb91b6a39a65dd40f1c4fcc4bfee1d29cb187b0bd8daf880b1a021eda9
SSDEEP 24576:Un2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:CaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\Recovery\WindowsRE\services.exe
Size 2.0MB
SHA256 b24287f8e9e0b7e6d1dbb0cc8290596799828ddceb7086dc2aad5a77247b3a18
MD5 b8eb2b7177ee143b097f38b7bab1c164
SHA1 76d2ac91fa0a5658fadcbfcedd68e4e6b5b95712
SHA512 7e7d01a8d366f0a8d0a06a065a026d4003970a80efc40af1a110d75e785d80a2b3e91400e097853da9dbb8f1583ab38c83476158e61644444757aac256244aa8
SSDEEP 24576:kn2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:SaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Recovery\WindowsRE\spoolsv.exe
Size 2.0MB
SHA256 059fe8404898c5f4beef52df3c85e1acd7919f6347cf66c4ae6fe96f0ae3308f
MD5 8bc6693ac7a690f8ce8455404cf192d8
SHA1 5502eb116fd9f6c636be3be22b02c0185ac08fdf
SHA512 162c80557fa02c679bb057ceb3a6508dd142f1a9c2a53b1638a9700754d69c19c83f5371e52e687ce7b3590306cf2f260845c73993cc7e927e9ae81ba7710c20
SSDEEP 24576:En2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:yaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sppsvc.exe

Path C:\Users\Default\sppsvc.exe
Size 2.0MB
SHA256 54407f425416b36b90fb26b1ed72a9126dd7e4e6ff833cd9bb1b0f77d31b160d
MD5 3b1fc3c26c0b389300f97131887434f0
SHA1 7e8d16c3c5b89f965e4c9224aefc292ee9e95abe
SHA512 69ab56dc54c2cbb59b56e2b39b48958e3b7b5fb125aab6f019b121cbc24b5f2ae41d77f41127aa25f8b4cb55970d5fd560105d6e86c0672e642547a7e9ed0219
SSDEEP 24576:kn2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:SaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sppsvc.exe

Path C:\Users\Default\sppsvc.exe
Size 2.0MB
SHA256 dbc9de07cc4fa4bf38eb7aff0836a5582978b4a727bc80678f6592d90d31627d
MD5 887f3034668e489794b361e5533969f6
SHA1 f0f67c6cf4c5d35c8d661e13c55dfea8b17964b9
SHA512 59e2232a84be8dbc478b813247c6d244b5869cb7510275880b9f2cf22711bc6713b27f7f46538febaa2233c009a1dfe016120aab905f3da3f1649786c77fa581
SSDEEP 24576:kn2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:SaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-7-0x000000001B3A0000-0x000000001B3B6000-memory.dmp

Download

memory/1044-0-0x00007FFDD3EB3000-0x00007FFDD3EB5000-memory.dmp

Download

memory/1044-9-0x000000001B570000-0x000000001B57C000-memory.dmp

Download

memory/1044-10-0x000000001B580000-0x000000001B58C000-memory.dmp

Download

memory/1044-11-0x000000001B590000-0x000000001B59C000-memory.dmp

Download

memory/1044-13-0x000000001B5B0000-0x000000001B5BE000-memory.dmp

Download

memory/1044-12-0x000000001B5A0000-0x000000001B5AE000-memory.dmp

Download

memory/1044-14-0x000000001B5C0000-0x000000001B5CA000-memory.dmp

Download

memory/1044-5-0x000000001B380000-0x000000001B388000-memory.dmp

Download

memory/1044-4-0x000000001B520000-0x000000001B570000-memory.dmp

Download

memory/1044-8-0x000000001B3C0000-0x000000001B416000-memory.dmp

Download

memory/1044-6-0x000000001B390000-0x000000001B3A0000-memory.dmp

Download

memory/1044-3-0x000000001B360000-0x000000001B37C000-memory.dmp

Download

memory/1044-2-0x00007FFDD3EB0000-0x00007FFDD4971000-memory.dmp

Download

memory/1044-1-0x0000000000560000-0x000000000076C000-memory.dmp

Download

memory/1044-284-0x00007FFDD3EB0000-0x00007FFDD4971000-memory.dmp

Download

memory/3720-283-0x0000000000F90000-0x000000000119C000-memory.dmp

Download

memory/3720-285-0x000000001D720000-0x000000001D776000-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\CRMLog\\System.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\System.exe\", \"C:\\Windows\\addins\\csrss.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\System.exe\", \"C:\\Windows\\addins\\csrss.exe\", \"C:\\Program Files\\MSBuild\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\System.exe\", \"C:\\Windows\\addins\\csrss.exe\", \"C:\\Program Files\\MSBuild\\RuntimeBroker.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\sysmon.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\System.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\sppsvc.exe\", \"C:\\Program Files\\Windows Media Player\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Users\\Default\\sppsvc.exe\", \"C:\\Windows\\Microsoft.NET\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\CRMLog\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	3b1fc3c26c0b389300f97131887434f0_NeikiAnalytics.exe