Analysis

  • max time kernel
    93s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 06:52

General

  • Target

    99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    99cf9d4ed1703c1fe24079c852a89400

  • SHA1

    da07e2174c7e28805c4da6df9f8bcfec4302f866

  • SHA256

    1b3d1421729b44d695b597ddec9f4f46e386e22c86d198e9e360fb6833712529

  • SHA512

    114a452dd5debd8a916d073e222a40242644905536f0bcf070608433f1ab5d268f0d9f82caa32a9cd5f2e617ea45d49bc87c641061d68b7830d24d65014d95db

  • SSDEEP

    49152:qH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:qHfE5Ad8Xd295UmGc

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3992
    • C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe
      "C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:3956
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Windows\AppReadiness\backgroundTaskHost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4292
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\AppReadiness\backgroundTaskHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:5064
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Windows\AppReadiness\backgroundTaskHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1028
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:400
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:100
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:900
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\explorer.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4048
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Tasks\explorer.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3920
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\explorer.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2768
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\ja-JP\lsass.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:5024
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\ja-JP\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:696
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\ja-JP\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows Media Player\ja-JP\lsass.exe

    Filesize

    2.7MB

    MD5

    587b47f9ccaddef32464dbe404aacc17

    SHA1

    ef0f2310873a825f3089f7050fdbf2ba50ab6ed8

    SHA256

    218e80c413445d0649cb707256635cae5fc189e890b0fca1cad782b3abdd60f7

    SHA512

    02a63bc8608aba5fa17471a8753e2fd196261fc059e6c66fc867150c8aef2ebf0b3be524dc5f6d225b932091f5e43dd33f248a0c167a480cb5163ca71b5cd5f8

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_45i11ryt.qlj.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Windows\AppReadiness\backgroundTaskHost.exe

    Filesize

    2.7MB

    MD5

    99cf9d4ed1703c1fe24079c852a89400

    SHA1

    da07e2174c7e28805c4da6df9f8bcfec4302f866

    SHA256

    1b3d1421729b44d695b597ddec9f4f46e386e22c86d198e9e360fb6833712529

    SHA512

    114a452dd5debd8a916d073e222a40242644905536f0bcf070608433f1ab5d268f0d9f82caa32a9cd5f2e617ea45d49bc87c641061d68b7830d24d65014d95db

  • memory/1796-16-0x000000001BA30000-0x000000001BA3C000-memory.dmp

    Filesize

    48KB

  • memory/1796-138-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

    Filesize

    10.8MB

  • memory/1796-17-0x000000001BA40000-0x000000001BA48000-memory.dmp

    Filesize

    32KB

  • memory/1796-6-0x0000000002FD0000-0x0000000002FD8000-memory.dmp

    Filesize

    32KB

  • memory/1796-5-0x000000001B960000-0x000000001B9B0000-memory.dmp

    Filesize

    320KB

  • memory/1796-8-0x0000000003140000-0x0000000003156000-memory.dmp

    Filesize

    88KB

  • memory/1796-9-0x0000000003160000-0x0000000003168000-memory.dmp

    Filesize

    32KB

  • memory/1796-10-0x0000000003170000-0x0000000003178000-memory.dmp

    Filesize

    32KB

  • memory/1796-11-0x0000000003180000-0x0000000003190000-memory.dmp

    Filesize

    64KB

  • memory/1796-12-0x000000001B9B0000-0x000000001B9BA000-memory.dmp

    Filesize

    40KB

  • memory/1796-13-0x000000001B9C0000-0x000000001BA16000-memory.dmp

    Filesize

    344KB

  • memory/1796-14-0x000000001BA10000-0x000000001BA18000-memory.dmp

    Filesize

    32KB

  • memory/1796-15-0x000000001BA20000-0x000000001BA28000-memory.dmp

    Filesize

    32KB

  • memory/1796-0-0x00007FF9F65B3000-0x00007FF9F65B5000-memory.dmp

    Filesize

    8KB

  • memory/1796-7-0x0000000003130000-0x0000000003140000-memory.dmp

    Filesize

    64KB

  • memory/1796-19-0x000000001C170000-0x000000001C17C000-memory.dmp

    Filesize

    48KB

  • memory/1796-4-0x0000000003110000-0x000000000312C000-memory.dmp

    Filesize

    112KB

  • memory/1796-20-0x000000001C3F0000-0x000000001C3F8000-memory.dmp

    Filesize

    32KB

  • memory/1796-22-0x000000001C390000-0x000000001C39C000-memory.dmp

    Filesize

    48KB

  • memory/1796-23-0x000000001C3A0000-0x000000001C3AC000-memory.dmp

    Filesize

    48KB

  • memory/1796-27-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

    Filesize

    10.8MB

  • memory/1796-25-0x000000001C410000-0x000000001C41A000-memory.dmp

    Filesize

    40KB

  • memory/1796-26-0x000000001C420000-0x000000001C42C000-memory.dmp

    Filesize

    48KB

  • memory/1796-24-0x000000001C400000-0x000000001C408000-memory.dmp

    Filesize

    32KB

  • memory/1796-21-0x000000001C380000-0x000000001C388000-memory.dmp

    Filesize

    32KB

  • memory/1796-30-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

    Filesize

    10.8MB

  • memory/1796-3-0x00000000016D0000-0x00000000016D8000-memory.dmp

    Filesize

    32KB

  • memory/1796-2-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

    Filesize

    10.8MB

  • memory/1796-1-0x0000000000AF0000-0x0000000000DB0000-memory.dmp

    Filesize

    2.8MB

  • memory/1796-18-0x000000001C160000-0x000000001C16C000-memory.dmp

    Filesize

    48KB

  • memory/3992-124-0x0000019D47620000-0x0000019D47642000-memory.dmp

    Filesize

    136KB