dcrat | 6010d342cb5d71301a5f43312c4d11e844f85cb3e8b84152a85fbdfbe0594d12

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
Size 3.0MB
Sample240517-a29jfshe21
SHA256 6010d342cb5d71301a5f43312c4d11e844f85cb3e8b84152a85fbdfbe0594d12
MD5 6c1f5d8c88959accc79396696fca4f40
SHA1 0d3d0aa5a6d57f6d6b4878fd8bb8a74abcfbf7f6
SHA512 24f1f222587a9d30d268970f9d8838228ebb7d983443b8c2f1d1ac75181310ab8fa70358f1963391b2c3e368bc9eb74abca8b53d36e1bc3ad43a7efda1b38c82
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	352	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2832	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2832	schtasks.exe	29

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2700-17-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat
behavioral1/memory/2700-19-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat
behavioral1/memory/2700-14-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat
behavioral1/memory/2700-13-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat
behavioral1/memory/2700-21-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1472	powershell.exe
1512	powershell.exe
2212	powershell.exe
1000	powershell.exe
1160	powershell.exe
1956	powershell.exe
536	powershell.exe
1952	powershell.exe
944	powershell.exe
1820	powershell.exe
928	powershell.exe
1028	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
1912	lsm.exe
1780	lsm.exe
316	lsm.exe
1496	lsm.exe
1720	lsm.exe
2292	lsm.exe

Loads dropped DLL 2 IoCs

pid	Process
2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2588 set thread context of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXDB1C.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\c5b4cb5e9653cc	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Portable Devices\f3b6ecef712a24	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXCEFF.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\RCXD713.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\explorer.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXCF00.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCXD103.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCXD104.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\explorer.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\cc11b995f2a76d	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\7a0fd90576e088	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\RCXD712.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXDB1B.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Program Files\RCXE409.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\Web\Wallpaper\Characters\RCXD309.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Windows\Downloaded Program Files\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\sppsvc.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\Web\Wallpaper\Characters\lsass.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Windows\Resources\Ease of Access Themes\sppsvc.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\RCXC612.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\Web\Wallpaper\Characters\RCXD308.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\Downloaded Program Files\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\RCXC611.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Windows\Web\Wallpaper\Characters\lsass.exe	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Windows\Web\Wallpaper\Characters\6203df4a6bafc7	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Windows\Downloaded Program Files\71d2c2dfff00c9	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCXE40A.tmp	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
File created	C:\Windows\Resources\Ease of Access Themes\0a1fd5f707cd16	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1752	schtasks.exe
2464	schtasks.exe
1700	schtasks.exe
536	schtasks.exe
1864	schtasks.exe
2972	schtasks.exe
2076	schtasks.exe
112	schtasks.exe
952	schtasks.exe
944	schtasks.exe
1800	schtasks.exe
1948	schtasks.exe
1764	schtasks.exe
2372	schtasks.exe
1936	schtasks.exe
2196	schtasks.exe
1440	schtasks.exe
1216	schtasks.exe
2236	schtasks.exe
1152	schtasks.exe
1620	schtasks.exe
2904	schtasks.exe
1944	schtasks.exe
2980	schtasks.exe
1816	schtasks.exe
2900	schtasks.exe
316	schtasks.exe
352	schtasks.exe
1528	schtasks.exe
2812	schtasks.exe
2808	schtasks.exe
756	schtasks.exe
2856	schtasks.exe
2068	schtasks.exe
1160	schtasks.exe
840	schtasks.exe
3000	schtasks.exe
1084	schtasks.exe
1540	schtasks.exe
712	schtasks.exe
1240	schtasks.exe
2456	schtasks.exe
1776	schtasks.exe
2072	schtasks.exe
1612	schtasks.exe
1320	schtasks.exe
1076	schtasks.exe
1720	schtasks.exe
2264	schtasks.exe
1572	schtasks.exe
1920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
2212	powershell.exe
1000	powershell.exe
1472	powershell.exe
1820	powershell.exe
1160	powershell.exe
1952	powershell.exe
1512	powershell.exe
1956	powershell.exe
928	powershell.exe
1028	powershell.exe
944	powershell.exe
536	powershell.exe
1912	lsm.exe
1912	lsm.exe
1912	lsm.exe
1912	lsm.exe
1912	lsm.exe
1912	lsm.exe
1912	lsm.exe
1912	lsm.exe
1912	lsm.exe
1912	lsm.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	1912	lsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28
PID 2588 wrote to memory of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28
PID 2588 wrote to memory of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28
PID 2588 wrote to memory of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28
PID 2588 wrote to memory of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28
PID 2588 wrote to memory of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28
PID 2588 wrote to memory of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28
PID 2588 wrote to memory of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28
PID 2588 wrote to memory of 2700	2588	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	28
PID 2700 wrote to memory of 1028	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	83
PID 2700 wrote to memory of 1028	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	83
PID 2700 wrote to memory of 1028	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	83
PID 2700 wrote to memory of 1028	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	83
PID 2700 wrote to memory of 1160	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	84
PID 2700 wrote to memory of 1160	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	84
PID 2700 wrote to memory of 1160	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	84
PID 2700 wrote to memory of 1160	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	84
PID 2700 wrote to memory of 1956	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	86
PID 2700 wrote to memory of 1956	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	86
PID 2700 wrote to memory of 1956	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	86
PID 2700 wrote to memory of 1956	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	86
PID 2700 wrote to memory of 536	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	87
PID 2700 wrote to memory of 536	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	87
PID 2700 wrote to memory of 536	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	87
PID 2700 wrote to memory of 536	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	87
PID 2700 wrote to memory of 1952	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	88
PID 2700 wrote to memory of 1952	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	88
PID 2700 wrote to memory of 1952	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	88
PID 2700 wrote to memory of 1952	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	88
PID 2700 wrote to memory of 1000	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	90
PID 2700 wrote to memory of 1000	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	90
PID 2700 wrote to memory of 1000	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	90
PID 2700 wrote to memory of 1000	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	90
PID 2700 wrote to memory of 928	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	92
PID 2700 wrote to memory of 928	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	92
PID 2700 wrote to memory of 928	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	92
PID 2700 wrote to memory of 928	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	92
PID 2700 wrote to memory of 1820	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	94
PID 2700 wrote to memory of 1820	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	94
PID 2700 wrote to memory of 1820	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	94
PID 2700 wrote to memory of 1820	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	94
PID 2700 wrote to memory of 1472	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	96
PID 2700 wrote to memory of 1472	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	96
PID 2700 wrote to memory of 1472	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	96
PID 2700 wrote to memory of 1472	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	96
PID 2700 wrote to memory of 2212	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	98
PID 2700 wrote to memory of 2212	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	98
PID 2700 wrote to memory of 2212	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	98
PID 2700 wrote to memory of 2212	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	98
PID 2700 wrote to memory of 944	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	99
PID 2700 wrote to memory of 944	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	99
PID 2700 wrote to memory of 944	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	99
PID 2700 wrote to memory of 944	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	99
PID 2700 wrote to memory of 1512	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	100
PID 2700 wrote to memory of 1512	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	100
PID 2700 wrote to memory of 1512	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	100
PID 2700 wrote to memory of 1512	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	100
PID 2700 wrote to memory of 1912	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	107
PID 2700 wrote to memory of 1912	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	107
PID 2700 wrote to memory of 1912	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	107
PID 2700 wrote to memory of 1912	2700	6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe	107
PID 1912 wrote to memory of 1780	1912	lsm.exe	108
PID 1912 wrote to memory of 1780	1912	lsm.exe	108
PID 1912 wrote to memory of 1780	1912	lsm.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1160
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:536
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1000
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe
    "C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe
      "C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe"
      4⤵
      Executes dropped EXE
      PID:1780
  - - C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe
      "C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe"
      4⤵
      Executes dropped EXE
      PID:316
  - - C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe
      "C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe"
      4⤵
      Executes dropped EXE
      PID:1496
  - - C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe
      "C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe"
      4⤵
      Executes dropped EXE
      PID:1720
  - - C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe
      "C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe"
      4⤵
      Executes dropped EXE
      PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\Resources\Ease of Access Themes\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\Ease of Access Themes\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Web\Wallpaper\Characters\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\Characters\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\Web\Wallpaper\Characters\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Documents\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\All Users\Documents\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics6" /sc MINUTE /mo 9 /tr "'C:\Windows\Downloaded Program Files\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics6" /sc MINUTE /mo 11 /tr "'C:\Windows\Downloaded Program Files\6c1f5d8c88959accc79396696fca4f40_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\MSOCache\All Users\services.exe
Size 3.0MB
SHA256 b46011504dec5187e4788bb00207b85f391cb3507d198312f4688e76885696c7
MD5 32c251ad2cd55ab8ca261f66ca56ba13
SHA1 55a14bb18c295e42d88149c57ab6f97806116feb
SHA512 c50a85d8d3f7c12daef7674038a83b216c5c603148d43c75e5613046e78b1282f4a7208017188f4298da7efaec39139c5ec49c81b9f23ed303199415ccc8fd98
SSDEEP 49152:QZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:E7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\services.exe
Size 3.0MB
SHA256 6010d342cb5d71301a5f43312c4d11e844f85cb3e8b84152a85fbdfbe0594d12
MD5 6c1f5d8c88959accc79396696fca4f40
SHA1 0d3d0aa5a6d57f6d6b4878fd8bb8a74abcfbf7f6
SHA512 24f1f222587a9d30d268970f9d8838228ebb7d983443b8c2f1d1ac75181310ab8fa70358f1963391b2c3e368bc9eb74abca8b53d36e1bc3ad43a7efda1b38c82
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\services.exe
Size 3.0MB
SHA256 6c15bb9a5e856d2af2eee2d4bd78c45a219ce5e598e9c069253d78a4f6671792
MD5 70331b729325294f7597faa5b9910526
SHA1 278c123ea6e1ef1264f81150b2f9b69a6f03d132
SHA512 f252dc669275faff486f9acf44a87aeefd146ff26a26e6bcb2114ebea5ef71e70c2d70be7ef2598fa62bb7985ab0a53e3666196bc9fcbe3b252c4c4b8a7799c8
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 2263abb46514894930655c20017ea072560a1f526c2b07e56c37d62c0b435cc2
MD5 df10fbbbba677f7b5048e20dbaf4e04e
SHA1 e6b245c6ab6804b21de3ce6ba0cebd3c3caf14f6
SHA512 06f7b2688f7cf1784e0a1cd1c37e39472e9255b78cf1ec1beccadbc122f399fafd1754ccf7745b04de042ad1cac7dd17197ec8d943f6bbacf8b83b559ebdd6ee
SSDEEP 96:gJOCIQM8vnqvsqvJCwodJOCIQM8vnqvsEHyqvJCworlnS9QHlgm1g7sTXlUVg:A2Q7Uob2Q7AHnorl0YgCg7sTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

audiodg.exe

Path C:\Users\Public\Documents\audiodg.exe
Size 3.0MB
SHA256 f266beb9b694b8734515225ea89ac8b046a5134a0b441ef2d76ca450988b00f8
MD5 3094021cc4b0148ee6f09b0f904d6a74
SHA1 08ceba1937c97b25b2145327591c81480f8ba6b5
SHA512 9c6250022fb4dfb8c42e483ebab0db782b0df608cabfdefb0ceb30a5ba8a8be083fc72a46202c2a4aa4efa4af214715af31a109bae8cfa802456851ae2cb7a2c
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1912-351-0x00000000003B0000-0x00000000006C0000-memory.dmp

Download

memory/2588-4-0x000000007488E000-0x000000007488F000-memory.dmp

Download

memory/2588-7-0x0000000009980000-0x0000000009BFA000-memory.dmp

Download

memory/2588-8-0x0000000009C00000-0x0000000009E74000-memory.dmp

Download

memory/2588-6-0x00000000005D0000-0x00000000005DA000-memory.dmp

Download

memory/2588-5-0x0000000074880000-0x0000000074F6E000-memory.dmp

Download

memory/2588-0-0x000000007488E000-0x000000007488F000-memory.dmp

Download

memory/2588-3-0x0000000000410000-0x0000000000426000-memory.dmp

Download

memory/2588-2-0x0000000074880000-0x0000000074F6E000-memory.dmp

Download

memory/2588-23-0x0000000074880000-0x0000000074F6E000-memory.dmp

Download

memory/2588-1-0x0000000000C40000-0x0000000000F50000-memory.dmp

Download

memory/2700-27-0x0000000000890000-0x00000000008AC000-memory.dmp

Download

memory/2700-36-0x0000000002570000-0x000000000257C000-memory.dmp

Download

memory/2700-21-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2700-24-0x0000000074880000-0x0000000074F6E000-memory.dmp

Download

memory/2700-25-0x0000000000220000-0x000000000022E000-memory.dmp

Download

memory/2700-26-0x0000000074880000-0x0000000074F6E000-memory.dmp

Download

memory/2700-13-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2700-29-0x00000000008C0000-0x00000000008D0000-memory.dmp

Download

memory/2700-28-0x00000000008B0000-0x00000000008B8000-memory.dmp

Download

memory/2700-31-0x0000000000930000-0x0000000000938000-memory.dmp

Download

memory/2700-30-0x0000000000990000-0x00000000009A6000-memory.dmp

Download

memory/2700-32-0x00000000024F0000-0x00000000024FC000-memory.dmp

Download

memory/2700-33-0x0000000004EF0000-0x0000000004F46000-memory.dmp

Download

memory/2700-34-0x0000000002510000-0x000000000251C000-memory.dmp

Download

memory/2700-35-0x0000000002520000-0x0000000002528000-memory.dmp

Download

memory/2700-11-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2700-38-0x00000000047D0000-0x00000000047E2000-memory.dmp

Download

memory/2700-37-0x00000000047C0000-0x00000000047C8000-memory.dmp

Download

memory/2700-39-0x00000000047F0000-0x00000000047FC000-memory.dmp

Download

memory/2700-40-0x0000000004C60000-0x0000000004C6A000-memory.dmp

Download

memory/2700-41-0x0000000004C70000-0x0000000004C7E000-memory.dmp

Download

memory/2700-42-0x0000000004CC0000-0x0000000004CC8000-memory.dmp

Download

memory/2700-43-0x0000000004CD0000-0x0000000004CD8000-memory.dmp

Download

memory/2700-44-0x0000000004CE0000-0x0000000004CEC000-memory.dmp

Download

memory/2700-14-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2700-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2700-22-0x0000000074880000-0x0000000074F6E000-memory.dmp

Download

memory/2700-19-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2700-17-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/2700-350-0x0000000074880000-0x0000000074F6E000-memory.dmp

Download

memory/2700-9-0x0000000000400000-0x0000000000648000-memory.dmp

Download