General

  • Target

    558e6b5b67b9a55c460d5029d46c4710_NeikiAnalytics

  • Size

    2.0MB

  • Sample

    240512-bncg8sce52

  • MD5

    558e6b5b67b9a55c460d5029d46c4710

  • SHA1

    80924cf479b79c5e446cd564840c69ae3bab5a21

  • SHA256

    0a5f54a07f964b6fc7e1b14081f660c8d2ed28b254fb66bee7d8a910ea143524

  • SHA512

    8f21d3e2a4c46e9ad9fcfa61a1cc8c631c416a03986a8e2401896199ad4ea732ccba9711194c3834607d97041df344b0f85dca9a7d5fb3d70877fdea3e843c19

  • SSDEEP

    24576:0n2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:iaTUv0jmtEttc

Malware Config

Targets

    • Target

      558e6b5b67b9a55c460d5029d46c4710_NeikiAnalytics

    • Size

      2.0MB

    • MD5

      558e6b5b67b9a55c460d5029d46c4710

    • SHA1

      80924cf479b79c5e446cd564840c69ae3bab5a21

    • SHA256

      0a5f54a07f964b6fc7e1b14081f660c8d2ed28b254fb66bee7d8a910ea143524

    • SHA512

      8f21d3e2a4c46e9ad9fcfa61a1cc8c631c416a03986a8e2401896199ad4ea732ccba9711194c3834607d97041df344b0f85dca9a7d5fb3d70877fdea3e843c19

    • SSDEEP

      24576:0n2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:iaTUv0jmtEttc

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies WinLogon for persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks