Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2024 23:17

General

  • Target

    6f74083d8fdf9cafb689ea9b31fa663dc35aec6224d7790f9dca94e5ec76a400_NeikiAnalytics.exe

  • Size

    1.0MB

  • MD5

    527496f64e5df0e8c2c0fc3dd26842d0

  • SHA1

    91632db63b9dbeba3ee61ea02168fef4e856606d

  • SHA256

    6f74083d8fdf9cafb689ea9b31fa663dc35aec6224d7790f9dca94e5ec76a400

  • SHA512

    c21c7c057c9a6a5d5222fe9125da4a880a80b1b180f316e2cb4a042a6dd16486c830533e7c81ab0ef8af4c2f784516d271c414b9b80558569cc6c7094a0b1eef

  • SSDEEP

    12288:fubxAa9sUFxZ8oq7URPvyKBozWeL+vSgmtjJcDVrCTZSXlVB0mGEB0aNN/cPUeWl:A9sUFxZq7URPt6RL6nBrEZUjGE/L8YZ

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 5 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 3 IoCs
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f74083d8fdf9cafb689ea9b31fa663dc35aec6224d7790f9dca94e5ec76a400_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6f74083d8fdf9cafb689ea9b31fa663dc35aec6224d7790f9dca94e5ec76a400_NeikiAnalytics.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:540
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Idle.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:404
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4932
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3036
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\taskhostw.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3076
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/540-0-0x00007FFD3E633000-0x00007FFD3E635000-memory.dmp
    Filesize

    8KB

  • memory/540-1-0x0000000000590000-0x00000000006A2000-memory.dmp
    Filesize

    1.1MB

  • memory/540-2-0x00007FFD3E630000-0x00007FFD3F0F1000-memory.dmp
    Filesize

    10.8MB

  • memory/540-4-0x00000000027C0000-0x00000000027D0000-memory.dmp
    Filesize

    64KB

  • memory/540-3-0x00000000027B0000-0x00000000027B8000-memory.dmp
    Filesize

    32KB

  • memory/540-5-0x00000000028E0000-0x00000000028EA000-memory.dmp
    Filesize

    40KB

  • memory/540-6-0x00000000028F0000-0x00000000028FC000-memory.dmp
    Filesize

    48KB

  • memory/540-7-0x0000000002900000-0x000000000290C000-memory.dmp
    Filesize

    48KB

  • memory/540-10-0x00007FFD3E630000-0x00007FFD3F0F1000-memory.dmp
    Filesize

    10.8MB

  • memory/540-13-0x00007FFD3E630000-0x00007FFD3F0F1000-memory.dmp
    Filesize

    10.8MB