Analysis

  • max time kernel
    140s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 02:46

General

  • Target

    842d88a85052060e936fdc2ea92b43a0_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    842d88a85052060e936fdc2ea92b43a0

  • SHA1

    4c2a334ee317b586bd284f5e4f514801cc65f3c5

  • SHA256

    6ced96c3c9f628cd9caa61fdc4d146a792a612539c923de90a93414099f4eddb

  • SHA512

    b6abab1932024a1c477716dc84c7b60714ec6e712cc5ce104c078972a20e89554b20c588233c5be33fef8a02ee10d653d34c9a3d0c490a596d6a068d1fa6c1eb

  • SSDEEP

    49152:iH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:iHfE5Ad8Xd295UmGc

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\842d88a85052060e936fdc2ea92b43a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\842d88a85052060e936fdc2ea92b43a0_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3236
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1884
    • C:\Windows\debug\sysmon.exe
      "C:\Windows\debug\sysmon.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:2196
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:388
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3568
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1608
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\debug\sysmon.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3252
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\debug\sysmon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3648
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Windows\debug\sysmon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3360
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
    1⤵
      PID:1512

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\WindowsRE\msedge.exe

      Filesize

      2.7MB

      MD5

      842d88a85052060e936fdc2ea92b43a0

      SHA1

      4c2a334ee317b586bd284f5e4f514801cc65f3c5

      SHA256

      6ced96c3c9f628cd9caa61fdc4d146a792a612539c923de90a93414099f4eddb

      SHA512

      b6abab1932024a1c477716dc84c7b60714ec6e712cc5ce104c078972a20e89554b20c588233c5be33fef8a02ee10d653d34c9a3d0c490a596d6a068d1fa6c1eb

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vu2habpp.34q.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1884-98-0x0000022459120000-0x0000022459142000-memory.dmp

      Filesize

      136KB

    • memory/2196-122-0x000000001B9E0000-0x000000001BA36000-memory.dmp

      Filesize

      344KB

    • memory/3236-16-0x000000001C4D0000-0x000000001C4DC000-memory.dmp

      Filesize

      48KB

    • memory/3236-19-0x000000001C500000-0x000000001C50C000-memory.dmp

      Filesize

      48KB

    • memory/3236-7-0x00000000033C0000-0x00000000033D0000-memory.dmp

      Filesize

      64KB

    • memory/3236-5-0x000000001BE10000-0x000000001BE60000-memory.dmp

      Filesize

      320KB

    • memory/3236-8-0x000000001BDC0000-0x000000001BDD6000-memory.dmp

      Filesize

      88KB

    • memory/3236-9-0x00000000033D0000-0x00000000033D8000-memory.dmp

      Filesize

      32KB

    • memory/3236-10-0x000000001BDE0000-0x000000001BDE8000-memory.dmp

      Filesize

      32KB

    • memory/3236-11-0x000000001BDF0000-0x000000001BE00000-memory.dmp

      Filesize

      64KB

    • memory/3236-12-0x000000001BE00000-0x000000001BE0A000-memory.dmp

      Filesize

      40KB

    • memory/3236-13-0x000000001BE60000-0x000000001BEB6000-memory.dmp

      Filesize

      344KB

    • memory/3236-14-0x000000001C4C0000-0x000000001C4C8000-memory.dmp

      Filesize

      32KB

    • memory/3236-15-0x000000001C5E0000-0x000000001C5E8000-memory.dmp

      Filesize

      32KB

    • memory/3236-0-0x00007FFB408D3000-0x00007FFB408D5000-memory.dmp

      Filesize

      8KB

    • memory/3236-17-0x000000001C4E0000-0x000000001C4E8000-memory.dmp

      Filesize

      32KB

    • memory/3236-18-0x000000001C4F0000-0x000000001C4FC000-memory.dmp

      Filesize

      48KB

    • memory/3236-6-0x00000000033B0000-0x00000000033B8000-memory.dmp

      Filesize

      32KB

    • memory/3236-20-0x000000001C580000-0x000000001C588000-memory.dmp

      Filesize

      32KB

    • memory/3236-21-0x000000001C510000-0x000000001C518000-memory.dmp

      Filesize

      32KB

    • memory/3236-23-0x000000001C530000-0x000000001C53C000-memory.dmp

      Filesize

      48KB

    • memory/3236-22-0x000000001C520000-0x000000001C52C000-memory.dmp

      Filesize

      48KB

    • memory/3236-26-0x000000001C5B0000-0x000000001C5BC000-memory.dmp

      Filesize

      48KB

    • memory/3236-25-0x000000001C5A0000-0x000000001C5AA000-memory.dmp

      Filesize

      40KB

    • memory/3236-24-0x000000001C590000-0x000000001C598000-memory.dmp

      Filesize

      32KB

    • memory/3236-27-0x00007FFB408D0000-0x00007FFB41391000-memory.dmp

      Filesize

      10.8MB

    • memory/3236-30-0x00007FFB408D0000-0x00007FFB41391000-memory.dmp

      Filesize

      10.8MB

    • memory/3236-4-0x00000000019D0000-0x00000000019EC000-memory.dmp

      Filesize

      112KB

    • memory/3236-3-0x00000000019C0000-0x00000000019C8000-memory.dmp

      Filesize

      32KB

    • memory/3236-2-0x00007FFB408D0000-0x00007FFB41391000-memory.dmp

      Filesize

      10.8MB

    • memory/3236-119-0x00007FFB408D0000-0x00007FFB41391000-memory.dmp

      Filesize

      10.8MB

    • memory/3236-1-0x0000000000EA0000-0x0000000001160000-memory.dmp

      Filesize

      2.8MB