Analysis
- max time kernel
126s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 08:37
Behavioral task
behavioral1
Sample
453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe
- Size 828KB
- Sample240604-kjg2labe89
- SHA256 ac94b28d14f8e7514435ea79f0831b7ec018a2901f39aa89911d134f93e07269
- MD5 453acc8b0c3f79698630704a9e9ec6a0
- SHA1 fb6547ad24c8b2df17f1c55194ec2ab682765de1
- SHA512 460708b5894c502d11f6fe5493446338fdb7ce26e2bec4ceba65251ccd8087c24593a1dc9a58207f0aeccd0991c30c9e022df0224268de50d5f76db1a6da3e60
- SSDEEP 12288:gjj5PhN5YiB0BZ6dE8KyN11UTq2pqAnZ7IaRdj1WMU:a51B0GdHf1STqA7rx1Wh
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- DcRat 56 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 4844 schtasks.exe 4064 schtasks.exe 1940 schtasks.exe 464 schtasks.exe 4524 schtasks.exe 3584 schtasks.exe 1368 schtasks.exe 3484 schtasks.exe 1548 schtasks.exe 1512 schtasks.exe 424 schtasks.exe 3248 schtasks.exe 1640 schtasks.exe 1216 schtasks.exe 4956 schtasks.exe 1748 schtasks.exe 3988 schtasks.exe 4588 schtasks.exe 5112 schtasks.exe 828 schtasks.exe 4372 schtasks.exe 3308 schtasks.exe 2072 schtasks.exe 1932 schtasks.exe 212 schtasks.exe 1700 schtasks.exe 448 schtasks.exe 1436 schtasks.exe 4692 schtasks.exe 1604 schtasks.exe 4124 schtasks.exe 3268 schtasks.exe 2168 schtasks.exe 3392 schtasks.exe 4856 schtasks.exe 1064 schtasks.exe 4088 schtasks.exe 4140 schtasks.exe File created C:\Program Files\Windows NT\Accessories\en-US\9e8d7a4ca61bd9 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 2892 schtasks.exe 5092 schtasks.exe File created C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 1040 schtasks.exe 932 schtasks.exe 3944 schtasks.exe 2724 schtasks.exe 4048 schtasks.exe 2868 schtasks.exe 5064 schtasks.exe 1924 schtasks.exe 408 schtasks.exe 3672 schtasks.exe 4732 schtasks.exe 1224 schtasks.exe 536 schtasks.exe 4928 schtasks.exe - Modifies WinLogon for persistence 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\", \"C:\\Windows\\Migration\\WTR\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\", \"C:\\Windows\\Migration\\WTR\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\", \"C:\\Windows\\Migration\\WTR\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\", \"C:\\Windows\\Migration\\WTR\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\", \"C:\\Windows\\Migration\\WTR\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Setup\\State\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\Users\\Default\\Favorites\\sppsvc.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\", \"C:\\Windows\\Migration\\WTR\\RuntimeBroker.exe\", \"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\", \"C:\\Users\\Default\\Recent\\sihost.exe\", \"C:\\Program Files\\Windows Security\\smss.exe\", \"C:\\Users\\All Users\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\", \"C:\\Windows\\debug\\unsecapp.exe\", \"C:\\Users\\Default\\System.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe - Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1040 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3268 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4088 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2168 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1748 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3672 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4956 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1224 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3484 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4844 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2724 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4524 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2072 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1924 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 408 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3944 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 828 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3392 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3248 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1940 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5064 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4064 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 464 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4140 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5112 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1640 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 424 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4124 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2868 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4928 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1368 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 536 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3308 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2892 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 212 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3988 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1216 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 448 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4588 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1700 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4692 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4732 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1512 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1436 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3584 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5092 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 932 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4856 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1604 4444 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1064 4444 schtasks.exe 83 -
resource yara_rule behavioral2/memory/3368-1-0x0000000000830000-0x0000000000906000-memory.dmp dcrat behavioral2/files/0x0007000000023441-11.dat dcrat - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 4800 smss.exe - Adds Run key to start application 2 TTPs 36 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Setup\\State\\dllhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default\\Recent\\sihost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Security\\smss.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Security\\smss.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default\\Recent\\sihost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Migration\\WTR\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Favorites\\sppsvc.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\All Users\\Templates\\dllhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Migration\\WTR\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Favorites\\sppsvc.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\debug\\unsecapp.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows NT\\Accessories\\en-US\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default\\System.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Internet Explorer\\images\\unsecapp.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\StartMenuExperienceHost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\All Users\\Templates\\dllhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Microsoft Office\\Office16\\OfficeClickToRun.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Setup\\State\\dllhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\debug\\unsecapp.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default\\System.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Uninstall Information\\RuntimeBroker.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 16 pastebin.com 18 pastebin.com - Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\Windows NT\Accessories\en-US\9e8d7a4ca61bd9 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office16\OfficeClickToRun.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office16\e6c9b481da804f 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Uninstall Information\RuntimeBroker.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File opened for modification C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\9e8d7a4ca61bd9 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\5940a34987c991 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Mail\Idle.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\StartMenuExperienceHost.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\55b276f4edf653 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Mail\6ccacd8608530f 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\images\unsecapp.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\images\29c1c3cc0f7685 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Windows Security\69ddcba757bf72 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Windows Security\smss.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Program Files\Uninstall Information\9e8d7a4ca61bd9 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\Setup\State\dllhost.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Windows\Setup\State\5940a34987c991 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Windows\debug\unsecapp.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Windows\debug\29c1c3cc0f7685 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Windows\Migration\WTR\RuntimeBroker.exe 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe File created C:\Windows\Migration\WTR\9e8d7a4ca61bd9 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1700 schtasks.exe 1640 schtasks.exe 212 schtasks.exe 4588 schtasks.exe 536 schtasks.exe 932 schtasks.exe 1040 schtasks.exe 3392 schtasks.exe 4064 schtasks.exe 3988 schtasks.exe 1216 schtasks.exe 3672 schtasks.exe 4140 schtasks.exe 424 schtasks.exe 4692 schtasks.exe 2168 schtasks.exe 2072 schtasks.exe 1368 schtasks.exe 2868 schtasks.exe 1436 schtasks.exe 4956 schtasks.exe 828 schtasks.exe 4048 schtasks.exe 2892 schtasks.exe 4732 schtasks.exe 3584 schtasks.exe 3248 schtasks.exe 1940 schtasks.exe 5064 schtasks.exe 4524 schtasks.exe 5112 schtasks.exe 3308 schtasks.exe 1604 schtasks.exe 1748 schtasks.exe 1932 schtasks.exe 1224 schtasks.exe 5092 schtasks.exe 1064 schtasks.exe 1548 schtasks.exe 1924 schtasks.exe 448 schtasks.exe 3944 schtasks.exe 1512 schtasks.exe 4856 schtasks.exe 4088 schtasks.exe 3484 schtasks.exe 4844 schtasks.exe 4124 schtasks.exe 4928 schtasks.exe 2724 schtasks.exe 4372 schtasks.exe 3268 schtasks.exe 408 schtasks.exe 464 schtasks.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 4800 smss.exe 4800 smss.exe 4800 smss.exe 4800 smss.exe 4800 smss.exe 4800 smss.exe 4800 smss.exe 4800 smss.exe 4800 smss.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4800 smss.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe Token: SeDebugPrivilege 4800 smss.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3368 wrote to memory of 4800 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 138 PID 3368 wrote to memory of 4800 3368 453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe 138 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\453acc8b0c3f79698630704a9e9ec6a0_NeikiAnalytics.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Program Files\Windows Security\smss.exe"C:\Program Files\Windows Security\smss.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\debug\unsecapp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\debug\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Windows\debug\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\System.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Default\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\unsecapp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\images\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Recent\sihost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Recent\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Recent\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Templates\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\StartMenuExperienceHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office16\OfficeClickToRun.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Office16\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Setup\State\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Favorites\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Favorites\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Favorites\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe
- Size 828KB
- SHA256 ac94b28d14f8e7514435ea79f0831b7ec018a2901f39aa89911d134f93e07269
- MD5 453acc8b0c3f79698630704a9e9ec6a0
- SHA1 fb6547ad24c8b2df17f1c55194ec2ab682765de1
- SHA512 460708b5894c502d11f6fe5493446338fdb7ce26e2bec4ceba65251ccd8087c24593a1dc9a58207f0aeccd0991c30c9e022df0224268de50d5f76db1a6da3e60
- SSDEEP 12288:gjj5PhN5YiB0BZ6dE8KyN11UTq2pqAnZ7IaRdj1WMU:a51B0GdHf1STqA7rx1Wh
- MD5 SHA1 SHA512 SSDEEP