Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    14-05-2024 06:52

General

  • Target

    99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    99cf9d4ed1703c1fe24079c852a89400

  • SHA1

    da07e2174c7e28805c4da6df9f8bcfec4302f866

  • SHA256

    1b3d1421729b44d695b597ddec9f4f46e386e22c86d198e9e360fb6833712529

  • SHA512

    114a452dd5debd8a916d073e222a40242644905536f0bcf070608433f1ab5d268f0d9f82caa32a9cd5f2e617ea45d49bc87c641061d68b7830d24d65014d95db

  • SSDEEP

    49152:qH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:qHfE5Ad8Xd295UmGc

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2976
    • C:\Windows\AppCompat\Programs\System.exe
      "C:\Windows\AppCompat\Programs\System.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:1796
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\AppCompat\Programs\System.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2644
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2820
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\AppCompat\Programs\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2724
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\System.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2460
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1892
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\AppCompat\Programs\System.exe

    Filesize

    2.7MB

    MD5

    99cf9d4ed1703c1fe24079c852a89400

    SHA1

    da07e2174c7e28805c4da6df9f8bcfec4302f866

    SHA256

    1b3d1421729b44d695b597ddec9f4f46e386e22c86d198e9e360fb6833712529

    SHA512

    114a452dd5debd8a916d073e222a40242644905536f0bcf070608433f1ab5d268f0d9f82caa32a9cd5f2e617ea45d49bc87c641061d68b7830d24d65014d95db

  • memory/1708-16-0x00000000006A0000-0x00000000006A8000-memory.dmp

    Filesize

    32KB

  • memory/1708-23-0x0000000000B90000-0x0000000000B98000-memory.dmp

    Filesize

    32KB

  • memory/1708-3-0x0000000000140000-0x0000000000148000-memory.dmp

    Filesize

    32KB

  • memory/1708-4-0x00000000003D0000-0x00000000003EC000-memory.dmp

    Filesize

    112KB

  • memory/1708-5-0x0000000000470000-0x0000000000478000-memory.dmp

    Filesize

    32KB

  • memory/1708-6-0x0000000000480000-0x0000000000490000-memory.dmp

    Filesize

    64KB

  • memory/1708-17-0x00000000006B0000-0x00000000006BC000-memory.dmp

    Filesize

    48KB

  • memory/1708-8-0x00000000004B0000-0x00000000004B8000-memory.dmp

    Filesize

    32KB

  • memory/1708-9-0x00000000004C0000-0x00000000004C8000-memory.dmp

    Filesize

    32KB

  • memory/1708-10-0x00000000004E0000-0x00000000004F0000-memory.dmp

    Filesize

    64KB

  • memory/1708-11-0x00000000004D0000-0x00000000004DA000-memory.dmp

    Filesize

    40KB

  • memory/1708-12-0x0000000000B00000-0x0000000000B56000-memory.dmp

    Filesize

    344KB

  • memory/1708-13-0x00000000004F0000-0x00000000004F8000-memory.dmp

    Filesize

    32KB

  • memory/1708-14-0x0000000000510000-0x0000000000518000-memory.dmp

    Filesize

    32KB

  • memory/1708-15-0x0000000000500000-0x000000000050C000-memory.dmp

    Filesize

    48KB

  • memory/1708-0-0x000007FEF5153000-0x000007FEF5154000-memory.dmp

    Filesize

    4KB

  • memory/1708-7-0x0000000000490000-0x00000000004A6000-memory.dmp

    Filesize

    88KB

  • memory/1708-18-0x00000000006C0000-0x00000000006CC000-memory.dmp

    Filesize

    48KB

  • memory/1708-19-0x0000000000B80000-0x0000000000B88000-memory.dmp

    Filesize

    32KB

  • memory/1708-21-0x0000000000B60000-0x0000000000B6C000-memory.dmp

    Filesize

    48KB

  • memory/1708-20-0x0000000000B50000-0x0000000000B58000-memory.dmp

    Filesize

    32KB

  • memory/1708-22-0x0000000000B70000-0x0000000000B7C000-memory.dmp

    Filesize

    48KB

  • memory/1708-2-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

    Filesize

    9.9MB

  • memory/1708-24-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

    Filesize

    40KB

  • memory/1708-25-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

    Filesize

    48KB

  • memory/1708-28-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

    Filesize

    9.9MB

  • memory/1708-1-0x0000000000FE0000-0x00000000012A0000-memory.dmp

    Filesize

    2.8MB

  • memory/1708-59-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

    Filesize

    9.9MB

  • memory/1796-58-0x00000000010D0000-0x0000000001390000-memory.dmp

    Filesize

    2.8MB

  • memory/1796-62-0x0000000000DC0000-0x0000000000E16000-memory.dmp

    Filesize

    344KB

  • memory/2976-60-0x000000001B780000-0x000000001BA62000-memory.dmp

    Filesize

    2.9MB

  • memory/2976-61-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

    Filesize

    32KB