General
-
Target
6fa32b421f0866b58f05526f85b6d590_NeikiAnalytics
-
Size
2.7MB
-
Sample
240514-egrv5ahh2s
-
MD5
6fa32b421f0866b58f05526f85b6d590
-
SHA1
fb2463e84c81171c07f1cd6f4b661231cc6e01c2
-
SHA256
f3227b8dbb23c0388c1c761da0751316e0963dac4e15ed1a62c92a8a2d0a4601
-
SHA512
e74839e7e6b7e7c3c78e658878f86813c1470d881110c0b2ee96e859dd9f9dccb89561d83aafbafdbf682eafbb40e92cc129aa489f067dc94861113109d7dd45
-
SSDEEP
49152:iH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:iHfE5Ad8Xd295UmGc
Behavioral task
behavioral1
Sample
6fa32b421f0866b58f05526f85b6d590_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6fa32b421f0866b58f05526f85b6d590_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
6fa32b421f0866b58f05526f85b6d590_NeikiAnalytics
-
Size
2.7MB
-
MD5
6fa32b421f0866b58f05526f85b6d590
-
SHA1
fb2463e84c81171c07f1cd6f4b661231cc6e01c2
-
SHA256
f3227b8dbb23c0388c1c761da0751316e0963dac4e15ed1a62c92a8a2d0a4601
-
SHA512
e74839e7e6b7e7c3c78e658878f86813c1470d881110c0b2ee96e859dd9f9dccb89561d83aafbafdbf682eafbb40e92cc129aa489f067dc94861113109d7dd45
-
SSDEEP
49152:iH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:iHfE5Ad8Xd295UmGc
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1