Analysis
- max time kernel
142s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
30/05/2024, 22:29
General
- Target 6aea1aed653c7920c564097de067bc69b78a69e31d88d9fcc79a6f24380e562d_NeikiAnalytics.exe
- Size 2.7MB
- Sample240530-2egcyach52
- SHA256 6aea1aed653c7920c564097de067bc69b78a69e31d88d9fcc79a6f24380e562d
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
- Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 6 IoCs
- DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 43 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- System policy modification 1 TTPs 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aea1aed653c7920c564097de067bc69b78a69e31d88d9fcc79a6f24380e562d_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6aea1aed653c7920c564097de067bc69b78a69e31d88d9fcc79a6f24380e562d_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\odt\msedge.exe"C:\odt\msedge.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\odt\msedge.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\odt\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 14 /tr "'C:\odt\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3104 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_f1q0ef0w.5wb.ps1
taskhostw.exe
memory/568-16-0x00000000030D0000-0x00000000030DC000-memory.dmp
memory/568-19-0x000000001C300000-0x000000001C30C000-memory.dmp
memory/568-4-0x0000000003220000-0x000000000323C000-memory.dmp
memory/568-5-0x000000001C310000-0x000000001C360000-memory.dmp
memory/568-7-0x000000001BB70000-0x000000001BB80000-memory.dmp
memory/568-6-0x0000000003100000-0x0000000003108000-memory.dmp
memory/568-9-0x000000001BBA0000-0x000000001BBA8000-memory.dmp
memory/568-8-0x000000001BB80000-0x000000001BB96000-memory.dmp
memory/568-18-0x000000001C2F0000-0x000000001C2FC000-memory.dmp
memory/568-11-0x000000001C2D0000-0x000000001C2E0000-memory.dmp
memory/568-12-0x00000000030A0000-0x00000000030AA000-memory.dmp
memory/568-13-0x000000001C360000-0x000000001C3B6000-memory.dmp
memory/568-14-0x00000000030B0000-0x00000000030B8000-memory.dmp
memory/568-15-0x00000000030C0000-0x00000000030C8000-memory.dmp
memory/568-3-0x00000000030F0000-0x00000000030F8000-memory.dmp
memory/568-0-0x00007FFA36593000-0x00007FFA36595000-memory.dmp
memory/568-10-0x000000001C2C0000-0x000000001C2C8000-memory.dmp
memory/568-17-0x000000001C2E0000-0x000000001C2E8000-memory.dmp
memory/568-20-0x000000001C5B0000-0x000000001C5B8000-memory.dmp
memory/568-22-0x000000001C5D0000-0x000000001C5DC000-memory.dmp
memory/568-23-0x000000001C5E0000-0x000000001C5EC000-memory.dmp
memory/568-21-0x000000001C5C0000-0x000000001C5C8000-memory.dmp
memory/568-25-0x00007FFA36590000-0x00007FFA37051000-memory.dmp
memory/568-24-0x000000001C630000-0x000000001C638000-memory.dmp
memory/568-27-0x000000001C650000-0x000000001C65C000-memory.dmp
memory/568-26-0x000000001C640000-0x000000001C64A000-memory.dmp
memory/568-28-0x00007FFA36590000-0x00007FFA37051000-memory.dmp
memory/568-31-0x00007FFA36590000-0x00007FFA37051000-memory.dmp
memory/568-2-0x00007FFA36590000-0x00007FFA37051000-memory.dmp
memory/568-129-0x00007FFA36590000-0x00007FFA37051000-memory.dmp
memory/568-1-0x0000000000D70000-0x0000000001030000-memory.dmp
memory/2656-108-0x00000227120D0000-0x00000227120F2000-memory.dmp