Overview

overview

10

Static

static

10

cb770c6707...cs.exe

windows7-x64

10

cb770c6707...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 07:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
  • Size 1.2MB
  • Sample240517-h1shjsfc47
  • SHA256 2d868b3214d7e0125297eb5e4a660aea6a1b043e37a5f02ecfdf309065db1490
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasioninfostealerrattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 51 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Checks whether UAC is enabled 1 TTPs 34 IoCs
    evasiontrojan
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 51 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5112
    • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
      "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1328
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7816171-11d3-4aeb-b50d-4373dcefa675.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4956
        • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
          "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:456
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52fd7673-c6ad-4877-a2e2-b441108ace58.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1444
            • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
              "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3424
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8479819c-b7a5-4af8-9fe6-7e525dd143be.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:628
                • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                  "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2600
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71204a80-f218-43d2-83a7-35ad36a3fd12.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1888
                    • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                      "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:5040
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0599d9a5-0525-4615-b2d4-e068aaf0ac9a.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:380
                        • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                          "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:1144
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b178b37-9422-4341-8069-a29943fec6e4.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1620
                            • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                              "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4708
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea31f165-b215-41c5-a9fc-5f60bdffd42d.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1212
                                • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                  "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2204
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a163f4ed-5b7b-497a-82ea-bd3d70576d00.vbs"
                                    17⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:5004
                                    • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                      "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                      18⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:4572
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\355b9c91-141d-43ea-af4c-daf605c53056.vbs"
                                        19⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:404
                                        • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                          "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                          20⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:1588
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d074b9ab-65f1-4fc9-b943-8365a54aef9d.vbs"
                                            21⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4388
                                            • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                              "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                              22⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:3396
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7b86c9a-7ccc-4069-9da0-e0b6a621d8cd.vbs"
                                                23⤵
                                                  PID:3704
                                                  • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                                    "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                                    24⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:1144
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc468be4-97cf-4bc4-bf7e-39ccc374d8e7.vbs"
                                                      25⤵
                                                        PID:5072
                                                        • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                                          "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                                          26⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:884
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f207821a-159a-48c6-8bec-56a1dca4824c.vbs"
                                                            27⤵
                                                              PID:1568
                                                              • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                                                "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                                                28⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:3844
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97649b49-0348-4336-92ee-a51d3be7bb66.vbs"
                                                                  29⤵
                                                                    PID:3916
                                                                    • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                                                      "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                                                      30⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:3300
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae6de20d-aca6-4f9b-aaf7-8f83cbbfc31a.vbs"
                                                                        31⤵
                                                                          PID:3912
                                                                          • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                                                            "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                                                            32⤵
                                                                            • UAC bypass
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • System policy modification
                                                                            PID:2940
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4942257a-d071-40ae-9279-b81122783e64.vbs"
                                                                              33⤵
                                                                                PID:3236
                                                                                • C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe
                                                                                  "C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe"
                                                                                  34⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:648
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ceca157a-0f8d-49ee-a569-c9170db9693a.vbs"
                                                                                33⤵
                                                                                  PID:2340
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1e302a9-0f26-48d9-ab27-80789d04763d.vbs"
                                                                              31⤵
                                                                                PID:4660
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5264a7f-dec4-4f30-94e1-7c95873ee157.vbs"
                                                                            29⤵
                                                                              PID:4400
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0cab9fd4-6630-454b-af64-7bedf10c32b0.vbs"
                                                                          27⤵
                                                                            PID:1076
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a7571d1-d237-4378-8219-29b0c121e9e6.vbs"
                                                                        25⤵
                                                                          PID:2796
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54bdb6d5-48c9-49b7-90bf-255d3f921683.vbs"
                                                                      23⤵
                                                                        PID:748
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\014bc770-c460-4a5e-bd0a-1d45dec0a7df.vbs"
                                                                    21⤵
                                                                      PID:1888
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79bc7a6d-7a8f-4595-bfd7-f18fc332dee8.vbs"
                                                                  19⤵
                                                                    PID:1216
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a3ff91c-dcea-4390-bc8a-c5378b5fd842.vbs"
                                                                17⤵
                                                                  PID:1496
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22b463f3-aa3d-4e01-935b-7042d49074e2.vbs"
                                                              15⤵
                                                                PID:2900
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34aca95e-4b3d-4248-a6aa-eebc2b24dcf7.vbs"
                                                            13⤵
                                                              PID:2552
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18b726f2-edff-47c7-b326-d08cf2ae4f11.vbs"
                                                          11⤵
                                                            PID:4452
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba549460-e840-41e3-b02f-b7d1ebeb13cd.vbs"
                                                        9⤵
                                                          PID:3820
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1f729fd-6246-4b21-97ee-ca6c4e61c020.vbs"
                                                      7⤵
                                                        PID:4696
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\01312f29-3732-47cd-b704-ae3be923ab76.vbs"
                                                    5⤵
                                                      PID:4900
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47a48475-b313-44d0-96c0-95c1cf0af06d.vbs"
                                                  3⤵
                                                    PID:4536
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cb770c6707968ba0a381f084dc5e0160_NeikiAnalyticsc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\AccountPictures\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3924
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:5064
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cb770c6707968ba0a381f084dc5e0160_NeikiAnalyticsc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3416
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2208
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3280
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1364
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cb770c6707968ba0a381f084dc5e0160_NeikiAnalyticsc" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1296
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics" /sc ONLOGON /tr "'C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1804
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cb770c6707968ba0a381f084dc5e0160_NeikiAnalyticsc" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2128
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\smss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2960
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4876
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3348
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\uk-UA\csrss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1444
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\uk-UA\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3316
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\uk-UA\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1436
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\dllhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1376
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\L2Schemas\dllhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:1680
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\L2Schemas\dllhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:320
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\sysmon.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4072
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\sysmon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:3720
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\sysmon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:428
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\smss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2456
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2172
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2152
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Cookies\smss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4432
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Cookies\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:2744
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Cookies\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Creates scheduled task(s)
                                                PID:4880

                                              Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    csrss.exe
                                                    • Path C:\Program Files\Internet Explorer\uk-UA\csrss.exe
                                                    • Size 1.2MB
                                                    • SHA256 2d868b3214d7e0125297eb5e4a660aea6a1b043e37a5f02ecfdf309065db1490
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe.log
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cb770c6707968ba0a381f084dc5e0160_NeikiAnalytics.exe.log
                                                    • Size 1KB
                                                    • SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    0599d9a5-0525-4615-b2d4-e068aaf0ac9a.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\0599d9a5-0525-4615-b2d4-e068aaf0ac9a.vbs
                                                    • Size 751B
                                                    • SHA256 bf1fa5644b65901cf5be21a261287f551a951079670405c4612eedeab07ff9dd
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    355b9c91-141d-43ea-af4c-daf605c53056.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\355b9c91-141d-43ea-af4c-daf605c53056.vbs
                                                    • Size 751B
                                                    • SHA256 c301f509f480629869f5387903d546c40c9fb8b93aa6d06a9aba6fe4c589f194
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    3b178b37-9422-4341-8069-a29943fec6e4.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\3b178b37-9422-4341-8069-a29943fec6e4.vbs
                                                    • Size 751B
                                                    • SHA256 f9e2ade11a7da918be49f96c76164ad6e38c2bf1488e76d5bb227d5d4f0c3022
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    47a48475-b313-44d0-96c0-95c1cf0af06d.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\47a48475-b313-44d0-96c0-95c1cf0af06d.vbs
                                                    • Size 527B
                                                    • SHA256 455823c68c765603d2aa0f85b56cbd90ea9b4f2f4c167e1e9b83f06924b2c557
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    4942257a-d071-40ae-9279-b81122783e64.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\4942257a-d071-40ae-9279-b81122783e64.vbs
                                                    • Size 751B
                                                    • SHA256 4f49cc252d2d6a5f0648532dccf1c0f774220b56facc3e9f87c82de0028292b0
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    52fd7673-c6ad-4877-a2e2-b441108ace58.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\52fd7673-c6ad-4877-a2e2-b441108ace58.vbs
                                                    • Size 750B
                                                    • SHA256 1f8d4406fec4d3fe6b7db926609ffd66e1ebe5159efafa12e8f3c984a782c151
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    71204a80-f218-43d2-83a7-35ad36a3fd12.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\71204a80-f218-43d2-83a7-35ad36a3fd12.vbs
                                                    • Size 751B
                                                    • SHA256 501cf997416e7e24200b6f2027dc319b8a399a7c0e4ea29049b989534cfb31ea
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    8479819c-b7a5-4af8-9fe6-7e525dd143be.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\8479819c-b7a5-4af8-9fe6-7e525dd143be.vbs
                                                    • Size 751B
                                                    • SHA256 7353eb70cc5dd93b0a070f7657da28d8006779f40d7ac413a3f9b229cbba2283
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    97649b49-0348-4336-92ee-a51d3be7bb66.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\97649b49-0348-4336-92ee-a51d3be7bb66.vbs
                                                    • Size 751B
                                                    • SHA256 6a9febdbf4fb62951d5cd2cce69c8233eb66675cbbb47979fb2142d5c28ba63c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    a163f4ed-5b7b-497a-82ea-bd3d70576d00.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\a163f4ed-5b7b-497a-82ea-bd3d70576d00.vbs
                                                    • Size 751B
                                                    • SHA256 f1d01d14947e392335cb80fda3f965686f1f682b8d64d8043271cc2bdf901d83
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    ae6de20d-aca6-4f9b-aaf7-8f83cbbfc31a.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ae6de20d-aca6-4f9b-aaf7-8f83cbbfc31a.vbs
                                                    • Size 751B
                                                    • SHA256 f8d70538ee1b2f256e82bd707363dde600da852b28ab6bdd776daecb7da83e8a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    c7816171-11d3-4aeb-b50d-4373dcefa675.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\c7816171-11d3-4aeb-b50d-4373dcefa675.vbs
                                                    • Size 751B
                                                    • SHA256 1c96582dbb8d374ca5aee895d1cd66cc4aa174f20ba25be351b06423701b887c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    c7b86c9a-7ccc-4069-9da0-e0b6a621d8cd.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\c7b86c9a-7ccc-4069-9da0-e0b6a621d8cd.vbs
                                                    • Size 751B
                                                    • SHA256 4b3c810c0c7d0f3688a3a3ce35bdcdc56e5cb657c1a183fc204c9437144f1c76
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    d074b9ab-65f1-4fc9-b943-8365a54aef9d.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\d074b9ab-65f1-4fc9-b943-8365a54aef9d.vbs
                                                    • Size 751B
                                                    • SHA256 76f7071dc86e3382b4f6568bdb7ee8f30ed066a11f91e7a9ed11752838827f6a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    ea31f165-b215-41c5-a9fc-5f60bdffd42d.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\ea31f165-b215-41c5-a9fc-5f60bdffd42d.vbs
                                                    • Size 751B
                                                    • SHA256 77dcb072ebfa3f40375589f060e3649495f31393139d0ac0087457ecfbed40a7
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    f207821a-159a-48c6-8bec-56a1dca4824c.vbs
                                                    • Path C:\Users\Admin\AppData\Local\Temp\f207821a-159a-48c6-8bec-56a1dca4824c.vbs
                                                    • Size 750B
                                                    • SHA256 df1b5cb0b8bce57c8e10721d730cbb7bfba88e77f7e1f2ba89169f77e09b74d1
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    memory/5112-10-0x000000001AE10000-0x000000001AE1C000-memory.dmp
                                                    Download

                                                    memory/5112-13-0x000000001AE90000-0x000000001AE9C000-memory.dmp
                                                    Download

                                                    memory/5112-21-0x000000001B520000-0x000000001B52C000-memory.dmp
                                                    Download

                                                    memory/5112-19-0x000000001B500000-0x000000001B508000-memory.dmp
                                                    Download

                                                    memory/5112-18-0x000000001B4F0000-0x000000001B4FC000-memory.dmp
                                                    Download

                                                    memory/5112-165-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp
                                                    Download

                                                    memory/5112-17-0x000000001B4E0000-0x000000001B4EE000-memory.dmp
                                                    Download

                                                    memory/5112-16-0x000000001B4D0000-0x000000001B4DA000-memory.dmp
                                                    Download

                                                    memory/5112-15-0x000000001B4C0000-0x000000001B4C8000-memory.dmp
                                                    Download

                                                    memory/5112-14-0x000000001B3B0000-0x000000001B3BC000-memory.dmp
                                                    Download

                                                    memory/5112-12-0x000000001AE30000-0x000000001AE38000-memory.dmp
                                                    Download

                                                    memory/5112-20-0x000000001B510000-0x000000001B51A000-memory.dmp
                                                    Download

                                                    memory/5112-11-0x000000001AE20000-0x000000001AE2C000-memory.dmp
                                                    Download

                                                    memory/5112-0-0x00007FF9A4673000-0x00007FF9A4675000-memory.dmp
                                                    Download

                                                    memory/5112-8-0x000000001ADF0000-0x000000001ADF8000-memory.dmp
                                                    Download

                                                    memory/5112-9-0x000000001AE00000-0x000000001AE0A000-memory.dmp
                                                    Download

                                                    memory/5112-7-0x0000000002500000-0x0000000002516000-memory.dmp
                                                    Download

                                                    memory/5112-4-0x000000001AE40000-0x000000001AE90000-memory.dmp
                                                    Download

                                                    memory/5112-5-0x00000000024E0000-0x00000000024E8000-memory.dmp
                                                    Download

                                                    memory/5112-6-0x00000000024F0000-0x0000000002500000-memory.dmp
                                                    Download

                                                    memory/5112-3-0x00000000024C0000-0x00000000024DC000-memory.dmp
                                                    Download

                                                    memory/5112-2-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp
                                                    Download

                                                    memory/5112-1-0x0000000000050000-0x000000000018A000-memory.dmp
                                                    Download