General
-
Target
558e6b5b67b9a55c460d5029d46c4710_NeikiAnalytics
-
Size
2.0MB
-
Sample
240512-bncg8sce52
-
MD5
558e6b5b67b9a55c460d5029d46c4710
-
SHA1
80924cf479b79c5e446cd564840c69ae3bab5a21
-
SHA256
0a5f54a07f964b6fc7e1b14081f660c8d2ed28b254fb66bee7d8a910ea143524
-
SHA512
8f21d3e2a4c46e9ad9fcfa61a1cc8c631c416a03986a8e2401896199ad4ea732ccba9711194c3834607d97041df344b0f85dca9a7d5fb3d70877fdea3e843c19
-
SSDEEP
24576:0n2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:iaTUv0jmtEttc
Behavioral task
behavioral1
Sample
558e6b5b67b9a55c460d5029d46c4710_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
558e6b5b67b9a55c460d5029d46c4710_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
558e6b5b67b9a55c460d5029d46c4710_NeikiAnalytics
-
Size
2.0MB
-
MD5
558e6b5b67b9a55c460d5029d46c4710
-
SHA1
80924cf479b79c5e446cd564840c69ae3bab5a21
-
SHA256
0a5f54a07f964b6fc7e1b14081f660c8d2ed28b254fb66bee7d8a910ea143524
-
SHA512
8f21d3e2a4c46e9ad9fcfa61a1cc8c631c416a03986a8e2401896199ad4ea732ccba9711194c3834607d97041df344b0f85dca9a7d5fb3d70877fdea3e843c19
-
SSDEEP
24576:0n2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:iaTUv0jmtEttc
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1