General
-
Target
303325a3e668a7a768c22ac2a39468a0_NeikiAnalytics
-
Size
2.9MB
-
Sample
240511-ycvwrsgh52
-
MD5
303325a3e668a7a768c22ac2a39468a0
-
SHA1
4624cbc1429001794a925a740d77b65c6285020d
-
SHA256
56b9bac125ad7b937c792f9647a822a9c48065b61d7aa4b23d19961d2524757c
-
SHA512
41bcc6b7fc33f489855b4e12690eb5d2df25d4bc4511974867fe919acadc719705b39b6e1335cbc9db40aba73d2b6275a5a19bdd13b6061029fa09d17f4554cf
-
SSDEEP
49152:f4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:QDKmzjWnC8Wikx1DUN2/Uq
Behavioral task
behavioral1
Sample
303325a3e668a7a768c22ac2a39468a0_NeikiAnalytics.exe
Resource
win7-20240220-en
Malware Config
Targets
-
-
Target
303325a3e668a7a768c22ac2a39468a0_NeikiAnalytics
-
Size
2.9MB
-
MD5
303325a3e668a7a768c22ac2a39468a0
-
SHA1
4624cbc1429001794a925a740d77b65c6285020d
-
SHA256
56b9bac125ad7b937c792f9647a822a9c48065b61d7aa4b23d19961d2524757c
-
SHA512
41bcc6b7fc33f489855b4e12690eb5d2df25d4bc4511974867fe919acadc719705b39b6e1335cbc9db40aba73d2b6275a5a19bdd13b6061029fa09d17f4554cf
-
SSDEEP
49152:f4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:QDKmzjWnC8Wikx1DUN2/Uq
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1