Analysis

  • max time kernel
    138s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 12:33

General

  • Target

    d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    d22711d7b799dc3db2c419f2fd5f9430

  • SHA1

    4ffaadc81a24afaad091adb758bc41361b9c6197

  • SHA256

    ac642f44dade714a85fb5d214db6250cab8e0934058dda42e9c369dabba97c71

  • SHA512

    331f3b6fc9155592062c06be8fabf595ea24dbc2af5af490e91b59dd6799b6c19badfa579867801c47502b9aea2cb0526e3b75fa4d063e64366e06c2e62ed1ee

  • SSDEEP

    49152:yH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:yHfE5Ad8Xd295UmGc

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:212
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A37ewxymSE.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3304
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1696
        • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe
          "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:4432
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Speech_OneCore\Engines\TTS\en-US\RuntimeBroker.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:392
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\TTS\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3972
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Speech_OneCore\Engines\TTS\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:5052
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1932
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3328
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4152

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\A37ewxymSE.bat

      Filesize

      238B

      MD5

      e71631470d8f5bd6de86309ae4842e33

      SHA1

      93aba1c69532f5195eb1b55dd1248c5452978467

      SHA256

      8eee39d0a206874d5652d0c81e489c4e6e354dad852fd6d4096191effa3638ce

      SHA512

      14f8eda2fad66e2d6a6db3fa017dd0f2cca14b975523f5761b52c208e35e4522118bdf589484c86692f82503f8b6bb63ecfb8244a8602d7c48c8b681aab09e41

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lxufzcld.vq3.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Windows\Speech_OneCore\Engines\TTS\en-US\RuntimeBroker.exe

      Filesize

      2.7MB

      MD5

      d22711d7b799dc3db2c419f2fd5f9430

      SHA1

      4ffaadc81a24afaad091adb758bc41361b9c6197

      SHA256

      ac642f44dade714a85fb5d214db6250cab8e0934058dda42e9c369dabba97c71

      SHA512

      331f3b6fc9155592062c06be8fabf595ea24dbc2af5af490e91b59dd6799b6c19badfa579867801c47502b9aea2cb0526e3b75fa4d063e64366e06c2e62ed1ee

    • memory/212-61-0x0000027A1CA30000-0x0000027A1CA52000-memory.dmp

      Filesize

      136KB

    • memory/4980-17-0x000000001B810000-0x000000001B818000-memory.dmp

      Filesize

      32KB

    • memory/4980-19-0x000000001B830000-0x000000001B83C000-memory.dmp

      Filesize

      48KB

    • memory/4980-6-0x000000001B0B0000-0x000000001B0B8000-memory.dmp

      Filesize

      32KB

    • memory/4980-5-0x000000001B740000-0x000000001B790000-memory.dmp

      Filesize

      320KB

    • memory/4980-8-0x000000001B6F0000-0x000000001B706000-memory.dmp

      Filesize

      88KB

    • memory/4980-10-0x000000001B720000-0x000000001B728000-memory.dmp

      Filesize

      32KB

    • memory/4980-9-0x000000001B0D0000-0x000000001B0D8000-memory.dmp

      Filesize

      32KB

    • memory/4980-11-0x000000001B710000-0x000000001B720000-memory.dmp

      Filesize

      64KB

    • memory/4980-12-0x000000001B730000-0x000000001B73A000-memory.dmp

      Filesize

      40KB

    • memory/4980-13-0x000000001B790000-0x000000001B7E6000-memory.dmp

      Filesize

      344KB

    • memory/4980-14-0x000000001B7E0000-0x000000001B7E8000-memory.dmp

      Filesize

      32KB

    • memory/4980-15-0x000000001B7F0000-0x000000001B7F8000-memory.dmp

      Filesize

      32KB

    • memory/4980-0-0x00007FFA71593000-0x00007FFA71595000-memory.dmp

      Filesize

      8KB

    • memory/4980-16-0x000000001B800000-0x000000001B80C000-memory.dmp

      Filesize

      48KB

    • memory/4980-18-0x000000001B820000-0x000000001B82C000-memory.dmp

      Filesize

      48KB

    • memory/4980-7-0x000000001B0C0000-0x000000001B0D0000-memory.dmp

      Filesize

      64KB

    • memory/4980-20-0x000000001BAB0000-0x000000001BAB8000-memory.dmp

      Filesize

      32KB

    • memory/4980-22-0x000000001BA50000-0x000000001BA5C000-memory.dmp

      Filesize

      48KB

    • memory/4980-23-0x000000001BA60000-0x000000001BA6C000-memory.dmp

      Filesize

      48KB

    • memory/4980-21-0x000000001BA40000-0x000000001BA48000-memory.dmp

      Filesize

      32KB

    • memory/4980-25-0x000000001BA80000-0x000000001BA8A000-memory.dmp

      Filesize

      40KB

    • memory/4980-26-0x000000001BA90000-0x000000001BA9C000-memory.dmp

      Filesize

      48KB

    • memory/4980-24-0x000000001BA70000-0x000000001BA78000-memory.dmp

      Filesize

      32KB

    • memory/4980-29-0x00007FFA71590000-0x00007FFA72051000-memory.dmp

      Filesize

      10.8MB

    • memory/4980-30-0x00007FFA71590000-0x00007FFA72051000-memory.dmp

      Filesize

      10.8MB

    • memory/4980-3-0x0000000002600000-0x0000000002608000-memory.dmp

      Filesize

      32KB

    • memory/4980-55-0x00007FFA71590000-0x00007FFA72051000-memory.dmp

      Filesize

      10.8MB

    • memory/4980-4-0x0000000002610000-0x000000000262C000-memory.dmp

      Filesize

      112KB

    • memory/4980-2-0x00007FFA71590000-0x00007FFA72051000-memory.dmp

      Filesize

      10.8MB

    • memory/4980-1-0x00000000001C0000-0x0000000000480000-memory.dmp

      Filesize

      2.8MB