dcrat | 51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
Size 3.0MB
Sample240529-mps26ace57
SHA256 51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8
MD5 afccad0c159b333b063275b03d7d0460
SHA1 8f45724c6e1ae3da2c2f93be7ae1b08827622483
SHA512 6d8cad66e976864d8b7a9f23cc8fbd75f5ff263745f430ef9319666ec1ee87f910adca7da8ca037c572607b298e6ef55d665ddefd5d0f7b88c4badb096106ddd
SSDEEP 49152:QZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:E7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	716	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	3036	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	3036	schtasks.exe	85

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4616-13-0x0000000000400000-0x0000000000648000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2300	powershell.exe
600	powershell.exe
4988	powershell.exe
2652	powershell.exe
2948	powershell.exe
1044	powershell.exe
4240	powershell.exe
1360	powershell.exe
2116	powershell.exe
4072	powershell.exe
2556	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 5 IoCs

pid	Process
1584	RuntimeBroker.exe
1760	RuntimeBroker.exe
2132	RuntimeBroker.exe
884	RuntimeBroker.exe
2880	RuntimeBroker.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com
48	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 4616	2504	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	90
PID 1584 set thread context of 2132	1584	RuntimeBroker.exe	140
PID 884 set thread context of 2880	884	RuntimeBroker.exe	144

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXFD94.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\RCXF37A.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\RCXF37B.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXF65B.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\Update\Offline\9e8d7a4ca61bd9	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File created	C:\Program Files\Windows Multimedia Platform\explorer.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File created	C:\Program Files\Windows Multimedia Platform\7a0fd90576e088	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\CrashReports\e1ef82546f0b02	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXF65A.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\explorer.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXFE12.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Panther\UnattendGC\e1ef82546f0b02	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File created	C:\Windows\Migration\smss.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Windows\Panther\UnattendGC\RCXF8ED.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Windows\Panther\UnattendGC\RCXF8EE.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Windows\Migration\RCX2C9.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Windows\Migration\smss.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File created	C:\Windows\Panther\UnattendGC\SppExtComObj.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File created	C:\Windows\Migration\69ddcba757bf72	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Windows\Panther\UnattendGC\SppExtComObj.exe	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
File opened for modification	C:\Windows\Migration\RCX24B.tmp	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1676	schtasks.exe
3724	schtasks.exe
4684	schtasks.exe
888	schtasks.exe
2012	schtasks.exe
3980	schtasks.exe
544	schtasks.exe
2092	schtasks.exe
5112	schtasks.exe
2392	schtasks.exe
760	schtasks.exe
2536	schtasks.exe
4704	schtasks.exe
716	schtasks.exe
1600	schtasks.exe
1940	schtasks.exe
968	schtasks.exe
1000	schtasks.exe
3052	schtasks.exe
4184	schtasks.exe
1140	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
2300	powershell.exe
2300	powershell.exe
1360	powershell.exe
1360	powershell.exe
2652	powershell.exe
2652	powershell.exe
4072	powershell.exe
4072	powershell.exe
4988	powershell.exe
4988	powershell.exe
1044	powershell.exe
1044	powershell.exe
4240	powershell.exe
4240	powershell.exe
2116	powershell.exe
2116	powershell.exe
600	powershell.exe
600	powershell.exe
2948	powershell.exe
2948	powershell.exe
2556	powershell.exe
2556	powershell.exe
4240	powershell.exe
2300	powershell.exe
4988	powershell.exe
1360	powershell.exe
1044	powershell.exe
4072	powershell.exe
2652	powershell.exe
2948	powershell.exe
2556	powershell.exe
600	powershell.exe
2116	powershell.exe
1584	RuntimeBroker.exe
1584	RuntimeBroker.exe
2132	RuntimeBroker.exe
2132	RuntimeBroker.exe
2132	RuntimeBroker.exe
2132	RuntimeBroker.exe
2132	RuntimeBroker.exe
2880	RuntimeBroker.exe
2880	RuntimeBroker.exe
2880	RuntimeBroker.exe
2880	RuntimeBroker.exe
2880	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	4072	powershell.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	1584	RuntimeBroker.exe
Token: SeDebugPrivilege	2132	RuntimeBroker.exe
Token: SeDebugPrivilege	2880	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4616	2504	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	90
PID 2504 wrote to memory of 4616	2504	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	90
PID 2504 wrote to memory of 4616	2504	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	90
PID 2504 wrote to memory of 4616	2504	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	90
PID 2504 wrote to memory of 4616	2504	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	90
PID 2504 wrote to memory of 4616	2504	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	90
PID 2504 wrote to memory of 4616	2504	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	90
PID 2504 wrote to memory of 4616	2504	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	90
PID 4616 wrote to memory of 1360	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	112
PID 4616 wrote to memory of 1360	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	112
PID 4616 wrote to memory of 1360	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	112
PID 4616 wrote to memory of 4988	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	113
PID 4616 wrote to memory of 4988	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	113
PID 4616 wrote to memory of 4988	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	113
PID 4616 wrote to memory of 4072	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	114
PID 4616 wrote to memory of 4072	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	114
PID 4616 wrote to memory of 4072	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	114
PID 4616 wrote to memory of 600	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	115
PID 4616 wrote to memory of 600	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	115
PID 4616 wrote to memory of 600	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	115
PID 4616 wrote to memory of 2116	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	116
PID 4616 wrote to memory of 2116	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	116
PID 4616 wrote to memory of 2116	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	116
PID 4616 wrote to memory of 2652	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	117
PID 4616 wrote to memory of 2652	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	117
PID 4616 wrote to memory of 2652	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	117
PID 4616 wrote to memory of 2948	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	119
PID 4616 wrote to memory of 2948	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	119
PID 4616 wrote to memory of 2948	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	119
PID 4616 wrote to memory of 2556	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	120
PID 4616 wrote to memory of 2556	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	120
PID 4616 wrote to memory of 2556	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	120
PID 4616 wrote to memory of 2300	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	121
PID 4616 wrote to memory of 2300	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	121
PID 4616 wrote to memory of 2300	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	121
PID 4616 wrote to memory of 1044	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	122
PID 4616 wrote to memory of 1044	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	122
PID 4616 wrote to memory of 1044	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	122
PID 4616 wrote to memory of 4240	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	123
PID 4616 wrote to memory of 4240	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	123
PID 4616 wrote to memory of 4240	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	123
PID 4616 wrote to memory of 380	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	134
PID 4616 wrote to memory of 380	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	134
PID 4616 wrote to memory of 380	4616	51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe	134
PID 380 wrote to memory of 3692	380	cmd.exe	136
PID 380 wrote to memory of 3692	380	cmd.exe	136
PID 380 wrote to memory of 3692	380	cmd.exe	136
PID 3692 wrote to memory of 1864	3692	w32tm.exe	137
PID 3692 wrote to memory of 1864	3692	w32tm.exe	137
PID 380 wrote to memory of 1584	380	cmd.exe	138
PID 380 wrote to memory of 1584	380	cmd.exe	138
PID 380 wrote to memory of 1584	380	cmd.exe	138
PID 1584 wrote to memory of 1760	1584	RuntimeBroker.exe	139
PID 1584 wrote to memory of 1760	1584	RuntimeBroker.exe	139
PID 1584 wrote to memory of 1760	1584	RuntimeBroker.exe	139
PID 1584 wrote to memory of 2132	1584	RuntimeBroker.exe	140
PID 1584 wrote to memory of 2132	1584	RuntimeBroker.exe	140
PID 1584 wrote to memory of 2132	1584	RuntimeBroker.exe	140
PID 1584 wrote to memory of 2132	1584	RuntimeBroker.exe	140
PID 1584 wrote to memory of 2132	1584	RuntimeBroker.exe	140
PID 1584 wrote to memory of 2132	1584	RuntimeBroker.exe	140
PID 1584 wrote to memory of 2132	1584	RuntimeBroker.exe	140
PID 1584 wrote to memory of 2132	1584	RuntimeBroker.exe	140
PID 2132 wrote to memory of 208	2132	RuntimeBroker.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TBpj7DN0qg.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3692
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1864
  - - C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe
      "C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        
        PID:1760
    - - C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2132
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8c6270a-c277-4013-9bc6-46f8a6e738dc.vbs"
        6⤵
        
        PID:208
        
        C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:884
        
        C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59639320-a72c-4ca3-a827-fd6ac84c4abf.vbs"
        6⤵
        
        PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\Offline\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\Panther\UnattendGC\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\UnattendGC\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics5" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Local Settings\51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics5" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Local Settings\51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Migration\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SppExtComObj.exe

Path C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe
Size 3.0MB
SHA256 51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8
MD5 afccad0c159b333b063275b03d7d0460
SHA1 8f45724c6e1ae3da2c2f93be7ae1b08827622483
SHA512 6d8cad66e976864d8b7a9f23cc8fbd75f5ff263745f430ef9319666ec1ee87f910adca7da8ca037c572607b298e6ef55d665ddefd5d0f7b88c4badb096106ddd
SSDEEP 49152:QZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:E7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

SppExtComObj.exe

Path C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe
Size 3.0MB
SHA256 ad4e879d27a01f23cd82ccfb01fa0f6981b7e66ba41b582ec634f433f80989bf
MD5 40272c41e3a093a9fcdae209c9d9d4a5
SHA1 356a5efd1b0bff6a028bbfd5e68fd65ea4fc544b
SHA512 c6ef427a9021f554f212ebcc2ffaede9d34dbe2e1f4a6f222c1b5a8a8df8fa5bf4a720c34971b8eac89fa40e3e48e2954de1cc1c249b1905c00fd17982e29a12
SSDEEP 49152:wZ2fRPDpkR3/hESpjo4uLDI3KoSPq3cXtFvOUcx3twYvr0G56/FBwzpTZoKh:k7ZJ89LDSKrq3iGnnw+1YXw9OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\51931391dee06a136406a4d104d5d7caeaf70eeefd20f3f0d477dc42a5fb6fa8NeikiAnalytics.exe.log
Size 1KB
SHA256 1ad8f00e485dbebe5a1f40f60b9e588e6563c4feef20b8134f335b3e16208dc3
MD5 95b0eabd8c9c516fc2d8632ff8f4dc10
SHA1 8118b2b54184a5add848198f36a905b9a511940e
SHA512 60147da0bc922f18e2eeae00dc7dda1caa432df6ed0f853cd4757535bf371536902c1ce1bc40db167540bbc79dedf9a742498fab5bafcbd1053c4b2dd9c79e62
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download