dcrat | 50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624a

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
Size 3.0MB
Sample240529-mbannaca43
SHA256 50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624a
MD5 acb4b3fd9eb572eca52ae15bba28cb80
SHA1 a5744b672dad3c6231dabab1f25cac4b497e420e
SHA512 782ad414748ee1ec3cca4feb78b5509e52871b78831706f68a53693ffac1bb8c66d6e2151d969707e37c1500ec7337e823f8bf16386d1aa26c0b67a24f30ea8f
SSDEEP 49152:QZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:E7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	1684	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	1684	schtasks.exe	98

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1396-13-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5032	powershell.exe
2832	powershell.exe
4188	powershell.exe
3600	powershell.exe
4844	powershell.exe
2608	powershell.exe
4312	powershell.exe
2836	powershell.exe
4852	powershell.exe
3136	powershell.exe
2532	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe

Executes dropped EXE 6 IoCs

pid	Process
5340	msedge.exe
5788	msedge.exe
5500	msedge.exe
1864	msedge.exe
5476	msedge.exe
4340	msedge.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	ip-api.com
80	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4616 set thread context of 1396	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	107
PID 5340 set thread context of 1864	5340	msedge.exe	168
PID 5476 set thread context of 4340	5476	msedge.exe	179

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\ClientX64\61a52ddc9dd915	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Stationery\9e8d7a4ca61bd9	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXCC88.tmp	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\RCXD53B.tmp	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\RCXD5B9.tmp	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXCC99.tmp	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Registration\CRMLog\lsass.exe	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File created	C:\Windows\Registration\CRMLog\6203df4a6bafc7	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCXC9C7.tmp	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCXCA45.tmp	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
File opened for modification	C:\Windows\Registration\CRMLog\lsass.exe	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3924	schtasks.exe
4696	schtasks.exe
1168	schtasks.exe
2300	schtasks.exe
3548	schtasks.exe
3932	schtasks.exe
3760	schtasks.exe
4808	schtasks.exe
4852	schtasks.exe
2388	schtasks.exe
2032	schtasks.exe
2132	schtasks.exe
3928	schtasks.exe
4500	schtasks.exe
1788	schtasks.exe
4576	schtasks.exe
1548	schtasks.exe
3888	schtasks.exe
4088	schtasks.exe
4964	schtasks.exe
4188	schtasks.exe
2908	schtasks.exe
2264	schtasks.exe
3992	schtasks.exe
628	schtasks.exe
2584	schtasks.exe
2412	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
3600	powershell.exe
3600	powershell.exe
3136	powershell.exe
3136	powershell.exe
2532	powershell.exe
2532	powershell.exe
4312	powershell.exe
4312	powershell.exe
5032	powershell.exe
5032	powershell.exe
2836	powershell.exe
2836	powershell.exe
2608	powershell.exe
2608	powershell.exe
4188	powershell.exe
4188	powershell.exe
2832	powershell.exe
2832	powershell.exe
4844	powershell.exe
4844	powershell.exe
4852	powershell.exe
4852	powershell.exe
3600	powershell.exe
2836	powershell.exe
2832	powershell.exe
2532	powershell.exe
2608	powershell.exe
3136	powershell.exe
4852	powershell.exe
5032	powershell.exe
4188	powershell.exe
4312	powershell.exe
4844	powershell.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
Token: SeDebugPrivilege	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	5340	msedge.exe
Token: SeDebugPrivilege	1864	msedge.exe
Token: SeDebugPrivilege	4340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1632	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	106
PID 4616 wrote to memory of 1632	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	106
PID 4616 wrote to memory of 1632	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	106
PID 4616 wrote to memory of 1396	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	107
PID 4616 wrote to memory of 1396	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	107
PID 4616 wrote to memory of 1396	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	107
PID 4616 wrote to memory of 1396	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	107
PID 4616 wrote to memory of 1396	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	107
PID 4616 wrote to memory of 1396	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	107
PID 4616 wrote to memory of 1396	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	107
PID 4616 wrote to memory of 1396	4616	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	107
PID 1396 wrote to memory of 2608	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	136
PID 1396 wrote to memory of 2608	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	136
PID 1396 wrote to memory of 2608	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	136
PID 1396 wrote to memory of 2836	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	137
PID 1396 wrote to memory of 2836	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	137
PID 1396 wrote to memory of 2836	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	137
PID 1396 wrote to memory of 4312	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	138
PID 1396 wrote to memory of 4312	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	138
PID 1396 wrote to memory of 4312	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	138
PID 1396 wrote to memory of 2532	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	140
PID 1396 wrote to memory of 2532	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	140
PID 1396 wrote to memory of 2532	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	140
PID 1396 wrote to memory of 3136	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	141
PID 1396 wrote to memory of 3136	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	141
PID 1396 wrote to memory of 3136	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	141
PID 1396 wrote to memory of 5032	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	142
PID 1396 wrote to memory of 5032	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	142
PID 1396 wrote to memory of 5032	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	142
PID 1396 wrote to memory of 4844	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	144
PID 1396 wrote to memory of 4844	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	144
PID 1396 wrote to memory of 4844	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	144
PID 1396 wrote to memory of 3600	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	145
PID 1396 wrote to memory of 3600	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	145
PID 1396 wrote to memory of 3600	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	145
PID 1396 wrote to memory of 4852	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	146
PID 1396 wrote to memory of 4852	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	146
PID 1396 wrote to memory of 4852	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	146
PID 1396 wrote to memory of 4188	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	148
PID 1396 wrote to memory of 4188	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	148
PID 1396 wrote to memory of 4188	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	148
PID 1396 wrote to memory of 2832	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	149
PID 1396 wrote to memory of 2832	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	149
PID 1396 wrote to memory of 2832	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	149
PID 1396 wrote to memory of 4008	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	158
PID 1396 wrote to memory of 4008	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	158
PID 1396 wrote to memory of 4008	1396	50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe	158
PID 4008 wrote to memory of 5496	4008	cmd.exe	160
PID 4008 wrote to memory of 5496	4008	cmd.exe	160
PID 4008 wrote to memory of 5496	4008	cmd.exe	160
PID 5496 wrote to memory of 5544	5496	w32tm.exe	161
PID 5496 wrote to memory of 5544	5496	w32tm.exe	161
PID 4008 wrote to memory of 5340	4008	cmd.exe	162
PID 4008 wrote to memory of 5340	4008	cmd.exe	162
PID 4008 wrote to memory of 5340	4008	cmd.exe	162
PID 5340 wrote to memory of 5788	5340	msedge.exe	166
PID 5340 wrote to memory of 5788	5340	msedge.exe	166
PID 5340 wrote to memory of 5788	5340	msedge.exe	166
PID 5340 wrote to memory of 5500	5340	msedge.exe	167
PID 5340 wrote to memory of 5500	5340	msedge.exe	167
PID 5340 wrote to memory of 5500	5340	msedge.exe	167
PID 5340 wrote to memory of 1864	5340	msedge.exe	168
PID 5340 wrote to memory of 1864	5340	msedge.exe	168
PID 5340 wrote to memory of 1864	5340	msedge.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe"
  2⤵
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MhpnDeYPqW.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5496
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:5544
  - - C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe
      "C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5340
    - - C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe"
        5⤵
        Executes dropped EXE
        
        PID:5788
    - - C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe"
        5⤵
        Executes dropped EXE
        
        PID:5500
    - - C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1864
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27a69242-d856-4b7b-a4d2-3ba64adfe09b.vbs"
        6⤵
        
        PID:1432
        
        C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5476
        
        C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4340
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f637c60-17c2-4a04-8ae9-a7f829d72751.vbs"
        6⤵
        
        PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4160,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:8
1⤵
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Pictures\Camera Roll\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Camera Roll\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Pictures\Camera Roll\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Libraries\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Libraries\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Program Files\Common Files\microsoft shared\Stationery\RuntimeBroker.exe
Size 3.0MB
SHA256 d10c55b879c7e24724176525f03f1e20eafe180bfc25721b18faa11c4f030d38
MD5 2392b3ff9ffdaeed53c907ac0c08f4cb
SHA1 df0e3d2a05b2eace9ce3fef8f729312b63785ec3
SHA512 e118d87509d26f518536302138c9fed9442609fe991b9c24574fb58ff04b6ed52f9960126bbba4bea586d553800d70fc93b88a32570f7a48b47e8c95f59aeeb7
SSDEEP 49152:AZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:07ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\50c457cecd795efa3fa25824db4a7c330dfac3af684a31af6c71a8354513624aNeikiAnalytics_NeikiAnalytics.exe.log
Size 1KB
SHA256 1ad8f00e485dbebe5a1f40f60b9e588e6563c4feef20b8134f335b3e16208dc3
MD5 95b0eabd8c9c516fc2d8632ff8f4dc10
SHA1 8118b2b54184a5add848198f36a905b9a511940e
SHA512 60147da0bc922f18e2eeae00dc7dda1caa432df6ed0f853cd4757535bf371536902c1ce1bc40db167540bbc79dedf9a742498fab5bafcbd1053c4b2dd9c79e62
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download