Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 06:52
Behavioral task
behavioral1
Sample
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
99cf9d4ed1703c1fe24079c852a89400
-
SHA1
da07e2174c7e28805c4da6df9f8bcfec4302f866
-
SHA256
1b3d1421729b44d695b597ddec9f4f46e386e22c86d198e9e360fb6833712529
-
SHA512
114a452dd5debd8a916d073e222a40242644905536f0bcf070608433f1ab5d268f0d9f82caa32a9cd5f2e617ea45d49bc87c641061d68b7830d24d65014d95db
-
SSDEEP
49152:qH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:qHfE5Ad8Xd295UmGc
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\System.exe\"" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\System.exe\", \"C:\\Users\\Admin\\System.exe\"" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe -
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 2876 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2820 2876 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2724 2876 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2460 2876 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1892 2876 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2532 2876 schtasks.exe -
Processes:
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exeSystem.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" System.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" System.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" System.exe -
Processes:
resource yara_rule behavioral1/memory/1708-1-0x0000000000FE0000-0x00000000012A0000-memory.dmp dcrat C:\Windows\AppCompat\Programs\System.exe dcrat behavioral1/memory/1796-58-0x00000000010D0000-0x0000000001390000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE 1 IoCs
Processes:
System.exepid process 1796 System.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\AppCompat\\Programs\\System.exe\"" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\AppCompat\\Programs\\System.exe\"" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\System.exe\"" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\System.exe\"" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe -
Processes:
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exeSystem.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA System.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" System.exe -
Drops file in Windows directory 4 IoCs
Processes:
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exedescription ioc process File created C:\Windows\AppCompat\Programs\27d1bcfc3c54e0 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe File opened for modification C:\Windows\AppCompat\Programs\RCX1279.tmp 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe File created C:\Windows\AppCompat\Programs\System.exe 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe File opened for modification C:\Windows\AppCompat\Programs\System.exe 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2644 schtasks.exe 2820 schtasks.exe 2724 schtasks.exe 2460 schtasks.exe 1892 schtasks.exe 2532 schtasks.exe -
Processes:
System.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 System.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 System.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exepowershell.exeSystem.exepid process 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe 2976 powershell.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe 1796 System.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exepowershell.exeSystem.exedescription pid process Token: SeDebugPrivilege 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Token: SeDebugPrivilege 2976 powershell.exe Token: SeDebugPrivilege 1796 System.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exedescription pid process target process PID 1708 wrote to memory of 2976 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe powershell.exe PID 1708 wrote to memory of 2976 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe powershell.exe PID 1708 wrote to memory of 2976 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe powershell.exe PID 1708 wrote to memory of 1796 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe System.exe PID 1708 wrote to memory of 1796 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe System.exe PID 1708 wrote to memory of 1796 1708 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe System.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
System.exe99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" System.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" System.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" System.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1708 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\AppCompat\Programs\System.exe"C:\Windows\AppCompat\Programs\System.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1796
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\AppCompat\Programs\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\AppCompat\Programs\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2532
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD599cf9d4ed1703c1fe24079c852a89400
SHA1da07e2174c7e28805c4da6df9f8bcfec4302f866
SHA2561b3d1421729b44d695b597ddec9f4f46e386e22c86d198e9e360fb6833712529
SHA512114a452dd5debd8a916d073e222a40242644905536f0bcf070608433f1ab5d268f0d9f82caa32a9cd5f2e617ea45d49bc87c641061d68b7830d24d65014d95db