General
-
Target
5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics
-
Size
2.9MB
-
Sample
240512-bf2gdscb29
-
MD5
5430b7081bc90a5d91a563328c7ae1d0
-
SHA1
7a7785368d1b276513949adfd5aeb7688e7fc8eb
-
SHA256
49556f419a3ec5e682c72cdcd04614f640f2b99fdabd35c2833073aad200e559
-
SHA512
698127b1707320d5d9489a322830b38e07e8e2cb19e335addafabaa2c3b4b16b1345a8a7a5d6823efd57b21272919ac05e0a3cb2a722defedef9243adc23fda0
-
SSDEEP
49152:H4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:YDKmzjWnC8Wikx1DUN2/Uq
Behavioral task
behavioral1
Sample
5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics.exe
Resource
win7-20240419-en
Malware Config
Targets
-
-
Target
5430b7081bc90a5d91a563328c7ae1d0_NeikiAnalytics
-
Size
2.9MB
-
MD5
5430b7081bc90a5d91a563328c7ae1d0
-
SHA1
7a7785368d1b276513949adfd5aeb7688e7fc8eb
-
SHA256
49556f419a3ec5e682c72cdcd04614f640f2b99fdabd35c2833073aad200e559
-
SHA512
698127b1707320d5d9489a322830b38e07e8e2cb19e335addafabaa2c3b4b16b1345a8a7a5d6823efd57b21272919ac05e0a3cb2a722defedef9243adc23fda0
-
SSDEEP
49152:H4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:YDKmzjWnC8Wikx1DUN2/Uq
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1