Analysis

  • max time kernel
    136s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 06:37

General

  • Target

    95f59fe3c8e5e66dbd3ec28962845e10_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    95f59fe3c8e5e66dbd3ec28962845e10

  • SHA1

    465475ba13cbd5282c197bea754d7be3cca36338

  • SHA256

    e105fa995b33fb8c05d0853890b99965dc5aae8fc37c4d365a2e4dcce6819ce6

  • SHA512

    03adbe754f1110cf16c04a8e61f8df6f5cc065b1392fd7d4e1ca2ef5d6294dd9dea0c4a902181282dd1e7972d592031abbee2c768b67dc4df92d19e346f5a824

  • SSDEEP

    49152:yH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:yHfE5Ad8Xd295UmGc

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 5 IoCs
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\95f59fe3c8e5e66dbd3ec28962845e10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\95f59fe3c8e5e66dbd3ec28962845e10_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4388
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XOrWkEHkVb.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1452
        • C:\Users\Admin\Cookies\RuntimeBroker.exe
          "C:\Users\Admin\Cookies\RuntimeBroker.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:2652
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3868
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1480
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1568
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Pictures\Camera Roll\sppsvc.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3024
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Camera Roll\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3796
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Pictures\Camera Roll\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1840
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2236
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1420
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3176
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Multimedia Platform\csrss.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:384
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2988
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2260
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Cookies\RuntimeBroker.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4228
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1272
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:852

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\RuntimeBroker.exe

      Filesize

      2.7MB

      MD5

      95f59fe3c8e5e66dbd3ec28962845e10

      SHA1

      465475ba13cbd5282c197bea754d7be3cca36338

      SHA256

      e105fa995b33fb8c05d0853890b99965dc5aae8fc37c4d365a2e4dcce6819ce6

      SHA512

      03adbe754f1110cf16c04a8e61f8df6f5cc065b1392fd7d4e1ca2ef5d6294dd9dea0c4a902181282dd1e7972d592031abbee2c768b67dc4df92d19e346f5a824

    • C:\Users\Admin\AppData\Local\Temp\XOrWkEHkVb.bat

      Filesize

      205B

      MD5

      4cd9980fff58c4c66c094f528c678d5c

      SHA1

      427a5f4d7562b425c02cf922c2f0136d874a668b

      SHA256

      21c8a62d323f64dd72b335ec9d25f2803b077951789c57eb895628a7a1d13000

      SHA512

      739bc72ffaeb16c18b25475a6a1093c9351c78024e17700750aaccf4e3ce581f5beb0be8aca547d05da19adc8c6e0b3daeaa42106bcf812876c27fc346861977

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_323bclqv.fv3.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/2660-16-0x000000001B7E0000-0x000000001B7EC000-memory.dmp

      Filesize

      48KB

    • memory/2660-1-0x00000000008B0000-0x0000000000B70000-memory.dmp

      Filesize

      2.8MB

    • memory/2660-18-0x000000001B800000-0x000000001B80C000-memory.dmp

      Filesize

      48KB

    • memory/2660-3-0x0000000001980000-0x0000000001988000-memory.dmp

      Filesize

      32KB

    • memory/2660-7-0x00000000019C0000-0x00000000019D0000-memory.dmp

      Filesize

      64KB

    • memory/2660-8-0x00000000019F0000-0x0000000001A06000-memory.dmp

      Filesize

      88KB

    • memory/2660-9-0x00000000019D0000-0x00000000019D8000-memory.dmp

      Filesize

      32KB

    • memory/2660-11-0x0000000001DD0000-0x0000000001DE0000-memory.dmp

      Filesize

      64KB

    • memory/2660-10-0x0000000001DC0000-0x0000000001DC8000-memory.dmp

      Filesize

      32KB

    • memory/2660-12-0x0000000001DA0000-0x0000000001DAA000-memory.dmp

      Filesize

      40KB

    • memory/2660-13-0x000000001B790000-0x000000001B7E6000-memory.dmp

      Filesize

      344KB

    • memory/2660-14-0x0000000001DB0000-0x0000000001DB8000-memory.dmp

      Filesize

      32KB

    • memory/2660-15-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

      Filesize

      32KB

    • memory/2660-0-0x00007FFA6C4E3000-0x00007FFA6C4E5000-memory.dmp

      Filesize

      8KB

    • memory/2660-4-0x0000000001990000-0x00000000019AC000-memory.dmp

      Filesize

      112KB

    • memory/2660-19-0x000000001BF20000-0x000000001BF2C000-memory.dmp

      Filesize

      48KB

    • memory/2660-5-0x000000001B740000-0x000000001B790000-memory.dmp

      Filesize

      320KB

    • memory/2660-20-0x000000001C180000-0x000000001C188000-memory.dmp

      Filesize

      32KB

    • memory/2660-23-0x000000001C150000-0x000000001C15C000-memory.dmp

      Filesize

      48KB

    • memory/2660-22-0x000000001C040000-0x000000001C04C000-memory.dmp

      Filesize

      48KB

    • memory/2660-21-0x000000001C030000-0x000000001C038000-memory.dmp

      Filesize

      32KB

    • memory/2660-24-0x000000001C160000-0x000000001C168000-memory.dmp

      Filesize

      32KB

    • memory/2660-26-0x000000001C1D0000-0x000000001C1DC000-memory.dmp

      Filesize

      48KB

    • memory/2660-27-0x00007FFA6C4E0000-0x00007FFA6CFA1000-memory.dmp

      Filesize

      10.8MB

    • memory/2660-25-0x000000001C170000-0x000000001C17A000-memory.dmp

      Filesize

      40KB

    • memory/2660-30-0x00007FFA6C4E0000-0x00007FFA6CFA1000-memory.dmp

      Filesize

      10.8MB

    • memory/2660-6-0x00000000019B0000-0x00000000019B8000-memory.dmp

      Filesize

      32KB

    • memory/2660-79-0x00007FFA6C4E0000-0x00007FFA6CFA1000-memory.dmp

      Filesize

      10.8MB

    • memory/2660-17-0x000000001B7F0000-0x000000001B7F8000-memory.dmp

      Filesize

      32KB

    • memory/2660-2-0x00007FFA6C4E0000-0x00007FFA6CFA1000-memory.dmp

      Filesize

      10.8MB

    • memory/4388-89-0x000001D14CEF0000-0x000001D14CF12000-memory.dmp

      Filesize

      136KB