General

  • Target

    5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics

  • Size

    952KB

  • Sample

    240514-c6c26afg6w

  • MD5

    5c8aee7bbd1b09e31178be12bc847c30

  • SHA1

    5cc34074f6c74cb0cbb3d282e9360a2d2eace451

  • SHA256

    e97d9651c1df50e5eb6847b6dde990e9fab3504c245557b61df65215df6de176

  • SHA512

    199f60f46d89bf3aadac7e2c67dbcdae716e3644b2db0c67e340cd55b47c78a1683acf27021850755d5ab66ee6850d3eba425e369604413b9897eb01f176ec2b

  • SSDEEP

    24576:W+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:x8/KfRTK

Malware Config

Targets

    • Target

      5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics

    • Size

      952KB

    • MD5

      5c8aee7bbd1b09e31178be12bc847c30

    • SHA1

      5cc34074f6c74cb0cbb3d282e9360a2d2eace451

    • SHA256

      e97d9651c1df50e5eb6847b6dde990e9fab3504c245557b61df65215df6de176

    • SHA512

      199f60f46d89bf3aadac7e2c67dbcdae716e3644b2db0c67e340cd55b47c78a1683acf27021850755d5ab66ee6850d3eba425e369604413b9897eb01f176ec2b

    • SSDEEP

      24576:W+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:x8/KfRTK

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies WinLogon for persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks