Analysis

  • max time kernel
    94s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 05:56

General

  • Target

    8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    8cdae0ef9f7f5ab79ec5671644e1a0f0

  • SHA1

    dfae9279327bb5658e9d95daae768bfaf4dca42f

  • SHA256

    e4c8b1c4527c76289bb4247f0a02d3dd85545bdc59530f005941455d05826aed

  • SHA512

    828146a24cc9ddac7e6e4f80df37356cbaf1bf93be1540b9cc3c5e49c7a46ef49f74ef48ba23998b5c388575aa792cc3f43043aadb15ff5b21eff841f49171f6

  • SSDEEP

    49152:yH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:yHfE5Ad8Xd295UmGc

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 12 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2788
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1428
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\90VwfBYSCa.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:3596
        • C:\Recovery\WindowsRE\dllhost.exe
          "C:\Recovery\WindowsRE\dllhost.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:1936
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4192
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2316
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2128
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1480
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4580
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2224
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1444
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1816
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2636
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4964
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:5092
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3616
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:5020
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4472
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4720
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3448
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:560
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe

      Filesize

      2.7MB

      MD5

      8cdae0ef9f7f5ab79ec5671644e1a0f0

      SHA1

      dfae9279327bb5658e9d95daae768bfaf4dca42f

      SHA256

      e4c8b1c4527c76289bb4247f0a02d3dd85545bdc59530f005941455d05826aed

      SHA512

      828146a24cc9ddac7e6e4f80df37356cbaf1bf93be1540b9cc3c5e49c7a46ef49f74ef48ba23998b5c388575aa792cc3f43043aadb15ff5b21eff841f49171f6

    • C:\Users\Admin\AppData\Local\Temp\90VwfBYSCa.bat

      Filesize

      198B

      MD5

      6c8b46f0687c544f6fbba92af4fa5290

      SHA1

      ad16b70110768a20cf7e7e00bf9a6c28d03b7474

      SHA256

      ac613ccce7765d79a89905d6d2210dedf05f5ed369f2da2c2840ae5dacfbe48f

      SHA512

      70e2644a607f36f0b86a358e00020ae934b39cc1313f54c1dfbdeba1bcef4f98c3a4925fe06e1b21beecf4ce8c91e632f1e9d7b5668230ff111517b3d8bb5b54

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rhjne0pt.wwd.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1428-99-0x0000020CDC3F0000-0x0000020CDC412000-memory.dmp

      Filesize

      136KB

    • memory/2788-16-0x000000001B010000-0x000000001B01C000-memory.dmp

      Filesize

      48KB

    • memory/2788-19-0x000000001B6F0000-0x000000001B6FC000-memory.dmp

      Filesize

      48KB

    • memory/2788-7-0x000000001AE70000-0x000000001AE80000-memory.dmp

      Filesize

      64KB

    • memory/2788-6-0x000000001AE60000-0x000000001AE68000-memory.dmp

      Filesize

      32KB

    • memory/2788-8-0x000000001AFA0000-0x000000001AFB6000-memory.dmp

      Filesize

      88KB

    • memory/2788-9-0x000000001AE80000-0x000000001AE88000-memory.dmp

      Filesize

      32KB

    • memory/2788-10-0x000000001AFE0000-0x000000001AFE8000-memory.dmp

      Filesize

      32KB

    • memory/2788-11-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

      Filesize

      64KB

    • memory/2788-12-0x000000001AFD0000-0x000000001AFDA000-memory.dmp

      Filesize

      40KB

    • memory/2788-13-0x000000001B680000-0x000000001B6D6000-memory.dmp

      Filesize

      344KB

    • memory/2788-14-0x000000001AFF0000-0x000000001AFF8000-memory.dmp

      Filesize

      32KB

    • memory/2788-15-0x000000001B000000-0x000000001B008000-memory.dmp

      Filesize

      32KB

    • memory/2788-0-0x00007FFFC7ED3000-0x00007FFFC7ED5000-memory.dmp

      Filesize

      8KB

    • memory/2788-17-0x000000001B6D0000-0x000000001B6D8000-memory.dmp

      Filesize

      32KB

    • memory/2788-18-0x000000001B6E0000-0x000000001B6EC000-memory.dmp

      Filesize

      48KB

    • memory/2788-5-0x000000001B630000-0x000000001B680000-memory.dmp

      Filesize

      320KB

    • memory/2788-20-0x000000001B800000-0x000000001B808000-memory.dmp

      Filesize

      32KB

    • memory/2788-23-0x000000001B930000-0x000000001B93C000-memory.dmp

      Filesize

      48KB

    • memory/2788-22-0x000000001B820000-0x000000001B82C000-memory.dmp

      Filesize

      48KB

    • memory/2788-21-0x000000001B810000-0x000000001B818000-memory.dmp

      Filesize

      32KB

    • memory/2788-24-0x000000001B940000-0x000000001B948000-memory.dmp

      Filesize

      32KB

    • memory/2788-27-0x000000001B990000-0x000000001B99C000-memory.dmp

      Filesize

      48KB

    • memory/2788-28-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

      Filesize

      10.8MB

    • memory/2788-26-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

      Filesize

      10.8MB

    • memory/2788-25-0x000000001BA90000-0x000000001BA9A000-memory.dmp

      Filesize

      40KB

    • memory/2788-35-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

      Filesize

      10.8MB

    • memory/2788-4-0x000000001AE40000-0x000000001AE5C000-memory.dmp

      Filesize

      112KB

    • memory/2788-3-0x000000001AE30000-0x000000001AE38000-memory.dmp

      Filesize

      32KB

    • memory/2788-2-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

      Filesize

      10.8MB

    • memory/2788-101-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

      Filesize

      10.8MB

    • memory/2788-1-0x0000000000080000-0x0000000000340000-memory.dmp

      Filesize

      2.8MB