dcrat | 39e9eb95baba36457a2d52c1172cd4b7135d3d3405b8f87899af5aab19774fdf

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Size 2.0MB
Sample240517-c1nlpsde88
SHA256 39e9eb95baba36457a2d52c1172cd4b7135d3d3405b8f87899af5aab19774fdf
MD5 8b7315310f64f655192f76ee38be0f60
SHA1 ead7c51d67763184aaeb479fb04f514a112f93da
SHA512 a9f2d642484714d5e32b482a53d127e9deb7e6f0ec3b4451b3bd8f658742e903b93da076fddcc8c70b6380fba5e28003b8b8afaa443452dbe6a06ad55b7308f7
SSDEEP 24576:Un2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:CaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Users\\Admin\\NetHood\\sihost.exe\", \"C:\\Users\\All Users\\Documents\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Users\\Admin\\NetHood\\sihost.exe\", \"C:\\Users\\All Users\\Documents\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Users\\Admin\\NetHood\\sihost.exe\", \"C:\\Users\\All Users\\Documents\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\spoolsv.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Users\\Admin\\NetHood\\sihost.exe\", \"C:\\Users\\All Users\\Documents\\Registry.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Users\\Admin\\NetHood\\sihost.exe\", \"C:\\Users\\All Users\\Documents\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Users\\Admin\\NetHood\\sihost.exe\", \"C:\\Users\\All Users\\Documents\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\backgroundTaskHost.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Registry.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Users\\Admin\\NetHood\\sihost.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	1680	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	1680	schtasks.exe	83

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2864-1-0x0000000000100000-0x000000000030C000-memory.dmp	dcrat
behavioral2/files/0x0007000000023443-23.dat	dcrat
behavioral2/files/0x00060000000006cf-77.dat	dcrat
behavioral2/files/0x000d0000000233a0-160.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2136	Registry.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Admin\\NetHood\\sihost.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Admin\\NetHood\\sihost.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Documents\\Registry.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Documents\\Registry.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\backgroundTaskHost.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\backgroundTaskHost.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Admin\\Registry.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Admin\\Registry.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\spoolsv.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\spoolsv.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Microsoft\\StartMenuExperienceHost.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\55b276f4edf653	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RCX65B5.tmp	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\eddb19405b7ce1	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCX5EEA.tmp	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RCX6633.tmp	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\lsass.exe	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\backgroundTaskHost.exe	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\f3b6ecef712a24	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft\RCX53B7.tmp	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\backgroundTaskHost.exe	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft\RCX53B6.tmp	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCX5EE9.tmp	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\diagnostics\scheduled\Maintenance\it-IT\dllhost.exe	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
740	schtasks.exe
1048	schtasks.exe
1340	schtasks.exe
4780	schtasks.exe
3488	schtasks.exe
876	schtasks.exe
2008	schtasks.exe
4892	schtasks.exe
4156	schtasks.exe
1432	schtasks.exe
1112	schtasks.exe
3076	schtasks.exe
4528	schtasks.exe
5100	schtasks.exe
2620	schtasks.exe
2364	schtasks.exe
4964	schtasks.exe
4968	schtasks.exe
2464	schtasks.exe
208	schtasks.exe
2768	schtasks.exe
3384	schtasks.exe
900	schtasks.exe
2540	schtasks.exe
2168	schtasks.exe
1696	schtasks.exe
1280	schtasks.exe
680	schtasks.exe
916	schtasks.exe
8	schtasks.exe
224	schtasks.exe
2744	schtasks.exe
4052	schtasks.exe
3928	schtasks.exe
4392	schtasks.exe
4380	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
2136	Registry.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
Token: SeDebugPrivilege	2136	Registry.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 1340	2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe	129
PID 2864 wrote to memory of 1340	2864	8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe	129
PID 1340 wrote to memory of 4468	1340	cmd.exe	131
PID 1340 wrote to memory of 4468	1340	cmd.exe	131
PID 1340 wrote to memory of 2136	1340	cmd.exe	134
PID 1340 wrote to memory of 2136	1340	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8b7315310f64f655192f76ee38be0f60_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4ReWEb5YKv.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4468
- - C:\Users\Admin\Registry.exe
    "C:\Users\Admin\Registry.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Admin\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\NetHood\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Documents\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Recovery\WindowsRE\RuntimeBroker.exe
Size 2.0MB
SHA256 a40559ae11b505f74df1ea84f9d52cc427618a481fca9edfe088b837e8fb7ef9
MD5 83e00c8c25d6e19667b08ffce3a6683a
SHA1 b6037272b69a70f6fec6054122d379cabe4a2860
SHA512 cc0278a434a6e4850149f7b5330a51e02f2a1dfbb787a3970a132d574857a4b3c74233e37887d32e3d9a0d9e77579386a56789547bf61933508e7b0c046fc7e2
SSDEEP 24576:0n2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:iaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchApp.exe

Path C:\Recovery\WindowsRE\SearchApp.exe
Size 2.0MB
SHA256 39e9eb95baba36457a2d52c1172cd4b7135d3d3405b8f87899af5aab19774fdf
MD5 8b7315310f64f655192f76ee38be0f60
SHA1 ead7c51d67763184aaeb479fb04f514a112f93da
SHA512 a9f2d642484714d5e32b482a53d127e9deb7e6f0ec3b4451b3bd8f658742e903b93da076fddcc8c70b6380fba5e28003b8b8afaa443452dbe6a06ad55b7308f7
SSDEEP 24576:Un2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:CaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Recovery\WindowsRE\spoolsv.exe
Size 2.0MB
SHA256 469ed25920c93f30ce83f6e9c1bdb3d3070ac38406aae53a565fd3f41c22cc2b
MD5 1a9ac7de18b772c3a18067965c030590
SHA1 5a87b44ee558d2d4c1cf98559c22cdf97724addf
SHA512 55a4eb64e6899913f429138e1cea2c076b739809399d3fee61da0233a2e761bf0dce0f1c9b6983b1d28b0f5789df76248721aa64bed612079c6382ccae4d182f
SSDEEP 24576:En2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:yaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

4ReWEb5YKv.bat

Path C:\Users\Admin\AppData\Local\Temp\4ReWEb5YKv.bat
Size 192B
SHA256 b0d501f573e36d34875c92d00c6ac47ef18aad5c759df9d23d8c081bc742a62d
MD5 5e7a3acc42866564ae55635efbc31943
SHA1 77f0dc397d346c0daa11be8764542868d030c3e4
SHA512 a839f4003b9f6b554a9fb67ee844c50061406ebc076da3863820ae5d966f34f89f4132ff36426477a7e532e2983b763302a184a224eca71194aaf0168f8aaa16
MD5 SHA1 SHA512

Submit Download

memory/2864-5-0x00000000009E0000-0x00000000009E8000-memory.dmp

Download

memory/2864-10-0x000000001B530000-0x000000001B53C000-memory.dmp

Download

memory/2864-4-0x000000001B4E0000-0x000000001B530000-memory.dmp

Download

memory/2864-7-0x0000000002470000-0x0000000002486000-memory.dmp

Download

memory/2864-8-0x000000001B490000-0x000000001B4E6000-memory.dmp

Download

memory/2864-9-0x0000000002490000-0x000000000249C000-memory.dmp

Download

memory/2864-11-0x000000001B540000-0x000000001B54C000-memory.dmp

Download

memory/2864-0-0x00007FFBF7793000-0x00007FFBF7795000-memory.dmp

Download

memory/2864-13-0x000000001B560000-0x000000001B56E000-memory.dmp

Download

memory/2864-12-0x000000001B550000-0x000000001B55E000-memory.dmp

Download

memory/2864-14-0x000000001B570000-0x000000001B57A000-memory.dmp

Download

memory/2864-6-0x0000000002460000-0x0000000002470000-memory.dmp

Download

memory/2864-3-0x0000000002440000-0x000000000245C000-memory.dmp

Download

memory/2864-2-0x00007FFBF7790000-0x00007FFBF8251000-memory.dmp

Download

memory/2864-179-0x00007FFBF7790000-0x00007FFBF8251000-memory.dmp

Download

memory/2864-1-0x0000000000100000-0x000000000030C000-memory.dmp

Download