General
-
Target
0679a4dd1cbe077ac163714c51df8150_NeikiAnalytics
-
Size
1.2MB
-
Sample
240512-nt22asdc9x
-
MD5
0679a4dd1cbe077ac163714c51df8150
-
SHA1
b2a052b5c18916324dc05e55c2adb360607a3ef3
-
SHA256
d4515124ee10073bf9de6fe1f57e407794f9db3bf5380bf13f8afc88453f4021
-
SHA512
4d8c2207ee2253f1529dd4f574e9f25a91ce558a94bbf565122c0dd38e9261223803cf7d86f1beb5cefc348645605805f46fbeb2296e56139c8c9f82308503c9
-
SSDEEP
24576:NR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:TJaDKf4p4UD1v
Behavioral task
behavioral1
Sample
0679a4dd1cbe077ac163714c51df8150_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0679a4dd1cbe077ac163714c51df8150_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
0679a4dd1cbe077ac163714c51df8150_NeikiAnalytics
-
Size
1.2MB
-
MD5
0679a4dd1cbe077ac163714c51df8150
-
SHA1
b2a052b5c18916324dc05e55c2adb360607a3ef3
-
SHA256
d4515124ee10073bf9de6fe1f57e407794f9db3bf5380bf13f8afc88453f4021
-
SHA512
4d8c2207ee2253f1529dd4f574e9f25a91ce558a94bbf565122c0dd38e9261223803cf7d86f1beb5cefc348645605805f46fbeb2296e56139c8c9f82308503c9
-
SSDEEP
24576:NR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:TJaDKf4p4UD1v
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1