General

  • Target

    0679a4dd1cbe077ac163714c51df8150_NeikiAnalytics

  • Size

    1.2MB

  • Sample

    240512-nt22asdc9x

  • MD5

    0679a4dd1cbe077ac163714c51df8150

  • SHA1

    b2a052b5c18916324dc05e55c2adb360607a3ef3

  • SHA256

    d4515124ee10073bf9de6fe1f57e407794f9db3bf5380bf13f8afc88453f4021

  • SHA512

    4d8c2207ee2253f1529dd4f574e9f25a91ce558a94bbf565122c0dd38e9261223803cf7d86f1beb5cefc348645605805f46fbeb2296e56139c8c9f82308503c9

  • SSDEEP

    24576:NR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:TJaDKf4p4UD1v

Malware Config

Targets

    • Target

      0679a4dd1cbe077ac163714c51df8150_NeikiAnalytics

    • Size

      1.2MB

    • MD5

      0679a4dd1cbe077ac163714c51df8150

    • SHA1

      b2a052b5c18916324dc05e55c2adb360607a3ef3

    • SHA256

      d4515124ee10073bf9de6fe1f57e407794f9db3bf5380bf13f8afc88453f4021

    • SHA512

      4d8c2207ee2253f1529dd4f574e9f25a91ce558a94bbf565122c0dd38e9261223803cf7d86f1beb5cefc348645605805f46fbeb2296e56139c8c9f82308503c9

    • SSDEEP

      24576:NR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:TJaDKf4p4UD1v

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks