Malware Analysis Report

2024-10-10 13:08

Sample ID 240616-1bpz8syerb
Target 0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe
SHA256 2ac2643ccc281d1f878cddae9635bb8d3bde694f9ccc55f792fa6256b1053859
Tags
rat dcrat evasion execution infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2ac2643ccc281d1f878cddae9635bb8d3bde694f9ccc55f792fa6256b1053859

Threat Level: Known bad

The file 0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion execution infostealer trojan

DcRat

Process spawned unexpected child process

UAC bypass

Dcrat family

DCRat payload

DCRat payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-16 21:28

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 21:28

Reported

2024-06-16 21:31

Platform

win7-20240220-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\DigitalLocker\de-DE\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\DigitalLocker\de-DE\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\DigitalLocker\de-DE\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\DigitalLocker\de-DE\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\DigitalLocker\de-DE\smss.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mozilla Firefox\browser\features\27d1bcfc3c54e0 C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\RCX1CD8.tmp C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\System.exe C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\System.exe C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\DigitalLocker\de-DE\RCX214C.tmp C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\DigitalLocker\de-DE\smss.exe C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File created C:\Windows\DigitalLocker\de-DE\smss.exe C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File created C:\Windows\DigitalLocker\de-DE\69ddcba757bf72 C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A
N/A N/A C:\Windows\DigitalLocker\de-DE\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2040 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2040 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2040 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2040 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2104 wrote to memory of 1580 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2104 wrote to memory of 1580 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2104 wrote to memory of 1580 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2104 wrote to memory of 1896 N/A C:\Windows\System32\cmd.exe C:\Windows\DigitalLocker\de-DE\smss.exe
PID 2104 wrote to memory of 1896 N/A C:\Windows\System32\cmd.exe C:\Windows\DigitalLocker\de-DE\smss.exe
PID 2104 wrote to memory of 1896 N/A C:\Windows\System32\cmd.exe C:\Windows\DigitalLocker\de-DE\smss.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\DigitalLocker\de-DE\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\DigitalLocker\de-DE\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\DigitalLocker\de-DE\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Recorded TV\Sample Media\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Recorded TV\Sample Media\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Desktop\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\browser\features\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\features\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\browser\features\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\de-DE\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\de-DE\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\DigitalLocker\de-DE\smss.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Recorded TV\Sample Media\dwm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\winlogon.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\Idle.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\features\System.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\de-DE\smss.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X2G7mwE2Li.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\DigitalLocker\de-DE\smss.exe

"C:\Windows\DigitalLocker\de-DE\smss.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 a0981341.xsph.ru udp
RU 141.8.192.6:80 a0981341.xsph.ru tcp

Files

memory/2040-0-0x000007FEF5C83000-0x000007FEF5C84000-memory.dmp

memory/2040-1-0x0000000000A60000-0x0000000000B72000-memory.dmp

memory/2040-2-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

memory/2040-3-0x0000000000340000-0x0000000000348000-memory.dmp

memory/2040-4-0x00000000004D0000-0x00000000004E0000-memory.dmp

memory/2040-5-0x00000000004E0000-0x00000000004EA000-memory.dmp

memory/2040-6-0x00000000004F0000-0x00000000004FC000-memory.dmp

memory/2040-7-0x0000000000640000-0x000000000064C000-memory.dmp

memory/2040-10-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe

MD5 0c5164e14ee2fd57fde4d9aefd70f3d0
SHA1 d61b976365aaafffb897d67e1dc82b0ab9152652
SHA256 2ac2643ccc281d1f878cddae9635bb8d3bde694f9ccc55f792fa6256b1053859
SHA512 d36cca2a61234a7b4c9009c5355fda18f137075006a0b084318bf5d60c3f0977f52be3c73a9ec251f34dfb0e147f1bf9a4935749dc77045f8df05bf3a5111733

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 fb6e2a2e38e4c8db4fad6224ad4be103
SHA1 ab7eccc665370a4db8a28bf7606e7444f452f543
SHA256 568678e24210dcef6e9bb93b83ccadb837cecd006f5a47e6e97ca0babc0ea777
SHA512 e8972236ae17dd5fbffd88452259ceb1f6aac690c60f3033c4b6c51eb28bedaa06d327d8c18b76c67683721f8d1feb4da896bd15ad070b19a5c4d3756182df5e

memory/2880-75-0x0000000001E80000-0x0000000001E88000-memory.dmp

memory/2880-74-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

memory/2040-78-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\X2G7mwE2Li.bat

MD5 2718a8118817027489b341311bd0e52b
SHA1 7979a3116ae9ba2a5381dbd97dda96d1ebb54543
SHA256 027291e8ff088cb079d1eff61b7ee5a4c6e87f22022a6a63e78e42a40e4d9add
SHA512 4c6ee6286a24eef6f425f92e3321258e8589797584d26060267fbbbd933491925264af67bf0ab2ca9db37bb20f932fce0cd3fbb2ca79e142c3c685059fdcf0ef

memory/1896-101-0x0000000001150000-0x0000000001262000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 21:28

Reported

2024-06-16 21:31

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\IdentityCRL\INT\taskhostw.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsPowerShell\explorer.exe C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File created C:\Program Files\WindowsPowerShell\7a0fd90576e088 C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\RCX3E82.tmp C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\explorer.exe C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\IdentityCRL\INT\taskhostw.exe C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File created C:\Windows\IdentityCRL\INT\ea9f0e6c9e2dcd C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\IdentityCRL\INT\RCX458A.tmp C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\IdentityCRL\INT\taskhostw.exe C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
N/A N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\IdentityCRL\INT\taskhostw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3484 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3484 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 3484 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2628 wrote to memory of 1576 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2628 wrote to memory of 1576 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2628 wrote to memory of 3988 N/A C:\Windows\System32\cmd.exe C:\Windows\IdentityCRL\INT\taskhostw.exe
PID 2628 wrote to memory of 3988 N/A C:\Windows\System32\cmd.exe C:\Windows\IdentityCRL\INT\taskhostw.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\IdentityCRL\INT\taskhostw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Packages\unsecapp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\All Users\Packages\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Packages\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Cookies\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Cookies\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\IdentityCRL\INT\taskhostw.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\taskhostw.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Windows\IdentityCRL\INT\taskhostw.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0c5164e14ee2fd57fde4d9aefd70f3d0_NeikiAnalytics.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Packages\unsecapp.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\csrss.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\INT\taskhostw.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wqBpcQR611.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\IdentityCRL\INT\taskhostw.exe

"C:\Windows\IdentityCRL\INT\taskhostw.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 a0981341.xsph.ru udp
RU 141.8.192.6:80 a0981341.xsph.ru tcp
US 8.8.8.8:53 6.192.8.141.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/3484-0-0x00007FFA4D3D3000-0x00007FFA4D3D5000-memory.dmp

memory/3484-1-0x0000000000FB0000-0x00000000010C2000-memory.dmp

memory/3484-2-0x00007FFA4D3D0000-0x00007FFA4DE91000-memory.dmp

memory/3484-3-0x00000000031E0000-0x00000000031E8000-memory.dmp

memory/3484-4-0x00000000031F0000-0x0000000003200000-memory.dmp

memory/3484-5-0x0000000003200000-0x000000000320A000-memory.dmp

memory/3484-6-0x0000000003210000-0x000000000321C000-memory.dmp

memory/3484-7-0x0000000003220000-0x000000000322C000-memory.dmp

memory/3484-10-0x00007FFA4D3D0000-0x00007FFA4DE91000-memory.dmp

memory/3484-11-0x00007FFA4D3D0000-0x00007FFA4DE91000-memory.dmp

C:\Windows\IdentityCRL\INT\taskhostw.exe

MD5 0c5164e14ee2fd57fde4d9aefd70f3d0
SHA1 d61b976365aaafffb897d67e1dc82b0ab9152652
SHA256 2ac2643ccc281d1f878cddae9635bb8d3bde694f9ccc55f792fa6256b1053859
SHA512 d36cca2a61234a7b4c9009c5355fda18f137075006a0b084318bf5d60c3f0977f52be3c73a9ec251f34dfb0e147f1bf9a4935749dc77045f8df05bf3a5111733

memory/3388-59-0x000001B550530000-0x000001B550552000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_roxog5es.oum.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3484-97-0x00007FFA4D3D0000-0x00007FFA4DE91000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wqBpcQR611.bat

MD5 45e426df54b9e63639d38c0e0aa20546
SHA1 12c5d3d6e273827c7e52924a60ebe9221eb151e6
SHA256 c96320063afc0697de6f7f60d6fde08a04ad4f8a223a1d8d0cbc41ef0fde3a1e
SHA512 4b112ace2d9318c6079d21c8a16cec5eb3988d6733537525e0c07880c30a44175def8b5ec66f0c08b743a97627c3d71d58d2c1050b8341e0e26346bc8619a592

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Windows\IdentityCRL\INT\taskhostw.exe

MD5 b9e917aa04f73c604dcb6a442a8f2514
SHA1 5f7c09b4ac6598fa99425b76ca8c388b16323db7
SHA256 cf7a3150b8ad412a04c303d6a3c2b243acdde1efa24fa6dfe893cfa4ec6cabcf
SHA512 96e35af8f80fff4143e6038ba95624a16a49aca10a6af40de59cfa1f7a11e136aea7384c9d085f9aafc5285cc6ceff4a3bf63fc11d2f6df5decf047cb144cabd

memory/3988-133-0x0000000000ED0000-0x0000000000FE2000-memory.dmp