General

  • Target

    99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics

  • Size

    2.7MB

  • Sample

    240514-hnd5dsec3z

  • MD5

    99cf9d4ed1703c1fe24079c852a89400

  • SHA1

    da07e2174c7e28805c4da6df9f8bcfec4302f866

  • SHA256

    1b3d1421729b44d695b597ddec9f4f46e386e22c86d198e9e360fb6833712529

  • SHA512

    114a452dd5debd8a916d073e222a40242644905536f0bcf070608433f1ab5d268f0d9f82caa32a9cd5f2e617ea45d49bc87c641061d68b7830d24d65014d95db

  • SSDEEP

    49152:qH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:qHfE5Ad8Xd295UmGc

Malware Config

Targets

    • Target

      99cf9d4ed1703c1fe24079c852a89400_NeikiAnalytics

    • Size

      2.7MB

    • MD5

      99cf9d4ed1703c1fe24079c852a89400

    • SHA1

      da07e2174c7e28805c4da6df9f8bcfec4302f866

    • SHA256

      1b3d1421729b44d695b597ddec9f4f46e386e22c86d198e9e360fb6833712529

    • SHA512

      114a452dd5debd8a916d073e222a40242644905536f0bcf070608433f1ab5d268f0d9f82caa32a9cd5f2e617ea45d49bc87c641061d68b7830d24d65014d95db

    • SSDEEP

      49152:qH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:qHfE5Ad8Xd295UmGc

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies WinLogon for persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks