Analysis
-
max time kernel
140s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 04:09
Behavioral task
behavioral1
Sample
734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe
-
Size
1.0MB
-
MD5
734f4ee215cafb87214221d572d5c660
-
SHA1
36b2b6ceae28a15c765dc28c19a6cebfe39866d5
-
SHA256
6637617b15474b43846983ba5fec458473677fd52408d6f09eaf557a8daa9d5a
-
SHA512
2070b0a7163280a48590955a8063869bbf521048163fe5e993283a06d92b25e7ca6b33782db1cd89f7631c21b646956cf42622e5945c6ba67f1f6ff962604a21
-
SSDEEP
12288:zXDkXlsYZVs6NanExuLCEHFT5J90YJqNn4qiXY+ii94vX1lnXMquJTloyf5II2xO:zzysYZV+Ec1OZ4XY+iLNXuJxXb
Malware Config
Signatures
-
DcRat 61 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1552 schtasks.exe 4760 schtasks.exe 1520 schtasks.exe 4756 schtasks.exe 948 schtasks.exe 4204 schtasks.exe 2504 schtasks.exe 2036 schtasks.exe 2924 schtasks.exe 3464 schtasks.exe 4576 schtasks.exe 4544 schtasks.exe 3028 schtasks.exe 3224 schtasks.exe 4204 schtasks.exe 3536 schtasks.exe 4444 schtasks.exe 3180 schtasks.exe 4656 schtasks.exe 4636 schtasks.exe 3228 schtasks.exe 1380 schtasks.exe 2936 schtasks.exe 3376 schtasks.exe 4424 schtasks.exe 2440 schtasks.exe 3704 schtasks.exe File created C:\Windows\PrintDialog\Assets\ea9f0e6c9e2dcd 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2908 schtasks.exe 5104 schtasks.exe 3540 schtasks.exe 3680 schtasks.exe 4544 schtasks.exe 560 schtasks.exe 2640 schtasks.exe 4736 schtasks.exe 2348 schtasks.exe 4824 schtasks.exe 4228 schtasks.exe 2732 schtasks.exe 988 schtasks.exe 4052 schtasks.exe 1612 schtasks.exe 4112 schtasks.exe 1232 schtasks.exe 3172 schtasks.exe 436 schtasks.exe 3668 schtasks.exe 3544 schtasks.exe 3476 schtasks.exe 3180 schtasks.exe 3028 schtasks.exe 948 schtasks.exe 2028 schtasks.exe 408 schtasks.exe 368 schtasks.exe 4952 schtasks.exe 4336 schtasks.exe 3260 schtasks.exe 2908 schtasks.exe 2636 schtasks.exe -
Process spawned unexpected child process 60 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3376 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4204 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3224 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4952 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4760 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4424 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4112 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5104 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3028 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2908 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3540 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2924 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2504 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4228 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2636 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4736 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1380 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2640 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 560 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4336 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3476 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4824 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4052 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 948 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3536 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3180 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3680 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4544 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3172 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4576 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1520 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2936 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 368 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3464 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4656 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3028 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2440 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3544 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3228 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1232 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4444 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1552 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 436 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2036 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3704 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4204 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4756 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 948 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2348 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3180 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4544 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3668 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4636 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2732 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2028 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 988 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3260 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 408 4152 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2908 4152 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/4648-1-0x0000000000AC0000-0x0000000000BD0000-memory.dmp dcrat C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3220 powershell.exe 4812 powershell.exe 3864 powershell.exe 2552 powershell.exe 4880 powershell.exe 3176 powershell.exe 3624 powershell.exe 8 powershell.exe 3464 powershell.exe 1148 powershell.exe 3636 powershell.exe 4900 powershell.exe 724 powershell.exe 4060 powershell.exe 3780 powershell.exe 3688 powershell.exe 2440 powershell.exe 3212 powershell.exe 4552 powershell.exe 2024 powershell.exe 4448 powershell.exe 4548 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
powershell.exepid process 2636 powershell.exe -
Drops file in Program Files directory 18 IoCs
Processes:
734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Windows Mail\e978f868350d50 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\55b276f4edf653 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\taskhostw.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Sidebar\powershell.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\System\powershell.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\System\e978f868350d50 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\backgroundTaskHost.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\powershell.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\StartMenuExperienceHost.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\ea9f0e6c9e2dcd 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\eddb19405b7ce1 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files\Windows Mail\powershell.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Sidebar\e978f868350d50 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\dwm.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\6cb0b6c459d5d3 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\eddb19405b7ce1 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\e978f868350d50 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe -
Drops file in Windows directory 6 IoCs
Processes:
734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exedescription ioc process File created C:\Windows\PrintDialog\Assets\taskhostw.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Windows\PrintDialog\Assets\ea9f0e6c9e2dcd 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Windows\Tasks\conhost.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Windows\Tasks\088424020bedd6 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Windows\Performance\WinSAT\powershell.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe File created C:\Windows\Performance\WinSAT\e978f868350d50 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 60 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3540 schtasks.exe 560 schtasks.exe 4576 schtasks.exe 368 schtasks.exe 3536 schtasks.exe 4636 schtasks.exe 2732 schtasks.exe 2036 schtasks.exe 2028 schtasks.exe 4424 schtasks.exe 4336 schtasks.exe 3180 schtasks.exe 948 schtasks.exe 408 schtasks.exe 4112 schtasks.exe 3028 schtasks.exe 3376 schtasks.exe 4204 schtasks.exe 4736 schtasks.exe 4824 schtasks.exe 2908 schtasks.exe 4952 schtasks.exe 2924 schtasks.exe 2640 schtasks.exe 3464 schtasks.exe 4544 schtasks.exe 1380 schtasks.exe 2936 schtasks.exe 2440 schtasks.exe 3704 schtasks.exe 3668 schtasks.exe 2636 schtasks.exe 3180 schtasks.exe 3260 schtasks.exe 1612 schtasks.exe 436 schtasks.exe 988 schtasks.exe 3224 schtasks.exe 2348 schtasks.exe 2504 schtasks.exe 3476 schtasks.exe 4204 schtasks.exe 948 schtasks.exe 4544 schtasks.exe 3028 schtasks.exe 1552 schtasks.exe 4760 schtasks.exe 3680 schtasks.exe 1520 schtasks.exe 4656 schtasks.exe 3544 schtasks.exe 4756 schtasks.exe 5104 schtasks.exe 4052 schtasks.exe 3172 schtasks.exe 1232 schtasks.exe 4444 schtasks.exe 2908 schtasks.exe 4228 schtasks.exe 3228 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exepid process 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 3780 powershell.exe 3780 powershell.exe 3220 powershell.exe 3220 powershell.exe 3864 powershell.exe 3864 powershell.exe 4880 powershell.exe 4880 powershell.exe 3176 powershell.exe 3176 powershell.exe 4060 powershell.exe 4060 powershell.exe 3464 powershell.exe 3464 powershell.exe 4548 powershell.exe 4548 powershell.exe 4812 powershell.exe 4812 powershell.exe 1148 powershell.exe 1148 powershell.exe 3636 powershell.exe 3636 powershell.exe 3176 powershell.exe 3464 powershell.exe 4812 powershell.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 3780 powershell.exe 3220 powershell.exe 4880 powershell.exe 3864 powershell.exe 1148 powershell.exe 4060 powershell.exe 3636 powershell.exe 4548 powershell.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe Token: SeDebugPrivilege 3780 powershell.exe Token: SeDebugPrivilege 3220 powershell.exe Token: SeDebugPrivilege 3864 powershell.exe Token: SeDebugPrivilege 4880 powershell.exe Token: SeDebugPrivilege 3176 powershell.exe Token: SeDebugPrivilege 4060 powershell.exe Token: SeDebugPrivilege 3464 powershell.exe Token: SeDebugPrivilege 3636 powershell.exe Token: SeDebugPrivilege 4548 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeDebugPrivilege 1148 powershell.exe Token: SeDebugPrivilege 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe Token: SeDebugPrivilege 2440 powershell.exe Token: SeDebugPrivilege 3688 powershell.exe Token: SeDebugPrivilege 4900 powershell.exe Token: SeDebugPrivilege 2636 powershell.exe Token: SeDebugPrivilege 2552 powershell.exe Token: SeDebugPrivilege 8 powershell.exe Token: SeDebugPrivilege 724 powershell.exe Token: SeDebugPrivilege 4552 powershell.exe Token: SeDebugPrivilege 3212 powershell.exe Token: SeDebugPrivilege 3624 powershell.exe Token: SeDebugPrivilege 4448 powershell.exe Token: SeDebugPrivilege 2024 powershell.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exedescription pid process target process PID 4648 wrote to memory of 4880 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 4880 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3220 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3220 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 4812 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 4812 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3864 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3864 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 4548 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 4548 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3780 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3780 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3464 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe schtasks.exe PID 4648 wrote to memory of 3464 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe schtasks.exe PID 4648 wrote to memory of 4060 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 4060 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3176 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3176 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 1148 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 1148 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3636 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 3636 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 4648 wrote to memory of 2168 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe PID 4648 wrote to memory of 2168 4648 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe PID 2168 wrote to memory of 2552 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 2552 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 4900 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 4900 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 3688 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 3688 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 2440 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 2440 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 3212 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 3212 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 724 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 724 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 8 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 8 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 4448 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 4448 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 3624 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 3624 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 2024 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 2024 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 4552 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 4552 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 2636 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe PID 2168 wrote to memory of 2636 2168 734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe"1⤵
- DcRat
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-
C:\Users\Admin\AppData\Local\Temp\734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4552
-
-
C:\Program Files\Windows Mail\powershell.exe"C:\Program Files\Windows Mail\powershell.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Windows\PrintDialog\Assets\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\PrintDialog\Assets\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\PrintDialog\Assets\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\Tasks\conhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Tasks\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\Tasks\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\powershell.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Public\Desktop\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Windows\Performance\WinSAT\powershell.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\powershell.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Users\Default\AppData\Local\sysmon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\AppData\Local\sysmon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Users\Default\AppData\Local\sysmon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\System\powershell.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\System\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\backgroundTaskHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\powershell.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Public\Pictures\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\Crypto\powershell.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Crypto\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\Crypto\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Package Cache\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}v64.8.8795\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}v64.8.8795\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Package Cache\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}v64.8.8795\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\powershell.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\powershell.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\StartMenuExperienceHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5734f4ee215cafb87214221d572d5c660
SHA136b2b6ceae28a15c765dc28c19a6cebfe39866d5
SHA2566637617b15474b43846983ba5fec458473677fd52408d6f09eaf557a8daa9d5a
SHA5122070b0a7163280a48590955a8063869bbf521048163fe5e993283a06d92b25e7ca6b33782db1cd89f7631c21b646956cf42622e5945c6ba67f1f6ff962604a21
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\734f4ee215cafb87214221d572d5c660_NeikiAnalytics.exe.log
Filesize1KB
MD5d6b092ab7af5db3a24256ae80aed33ca
SHA1e599b69e29c009b9fb76b536d75027ced6e6ad04
SHA256d08e5b3d500ea8c297061b409b3494687acdc722d2c09ec6777731a50984d1fc
SHA5123cc8406ec358856210d477cd434a43e2ede988d9e24ea84190220a4fb31619fd97b877cd3f9a7484199a20007a270d89951807ddaf369be032038148f1a37198
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD54165c906a376e655973cef247b5128f1
SHA1c6299b6ab8b2db841900de376e9c4d676d61131e
SHA256fb0b3c822d300abbb892e6f218d6b4b62b80bb26d9184d1f4c731600053a3fc4
SHA51215783f2d3687388339c06423bd18c17a5704cd367bf1a1d08e436088984c0b5c52dc88d3b8455495a8051ba9f977aae34b69453e5ee252d928e74dcdebd4a11a
-
Filesize
944B
MD5eb033be02578f9635ec47bdc1de5c3fb
SHA1ec356bc87381354a06baa9c30e8c3ac3d30e0f6f
SHA256bd827af3192bf83c75a32e51ed2de83bd3b90d6b99350721a189a57cec15d063
SHA5124d8778503646f7016df73ff9d204760f4fe4d2b24157920ac3e5651653373975b2f2d229530143059f11b16c42822ad7963e628ad6066022ee712c17d90595ed
-
Filesize
944B
MD5e3b6cc0fbea08a0831f0026a696db8b8
SHA14e32202d4700061cfd80d55e42798131c9f530d4
SHA2563284cae7b82be99d93064390ba071ba4321f3f24dd21515b37b2ca9f31b2e8d5
SHA5126a06856f360b48c8bc8a15ffb8d7a6604ec357bcb1d0fad5d71a2cb876929a7b67eb40ba4493998ab1bbae8cb71212e124276f27d5c138a135041c27a41a0b7a
-
Filesize
944B
MD5343936da192fbcb88e6f4fa5df6dcbdf
SHA10ff69cfae2f1bf7a50cd742fc05cbc16aa97cd7d
SHA256f010b8be85b88b8e73c61510b5b6c6276d78b4d5d9fca075172f6cff157f1e82
SHA51263021aeb9c2fadb63b665a0544a8246c97a8e07ad4c525a5caefa47f9ca40c8c8247820b615df6801d886be0c774919116a7e921b6fee17bc7fe46019815b1b7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82