General

  • Target

    c564138a5dfe37ca9392c0ed3722bb10_NeikiAnalytics

  • Size

    2.4MB

  • Sample

    240514-n3eblaef76

  • MD5

    c564138a5dfe37ca9392c0ed3722bb10

  • SHA1

    b859f2931678370ec7323284c48ee84420403dc6

  • SHA256

    f4abbf4717010d698712c6f85944d73755d0fc30a60844fc6d0c9d86822cca38

  • SHA512

    d0f92d165a455d838e9ffe83d4b8d5843ef65315ff2fe151bfebe6a09d1c8b8be842c797000fc46238a37f76b137bd6d491a84b7cd84e2412d96337cab9a6deb

  • SSDEEP

    24576:XF/Qs4a9rtQ/D5ey/A5m27P8fIeWRvtuEpjgbnvPQN5vYB9n5g9U0MOMJwPQ+3oS:XF6KNjgZwQ+33e76

Malware Config

Targets

    • Target

      c564138a5dfe37ca9392c0ed3722bb10_NeikiAnalytics

    • Size

      2.4MB

    • MD5

      c564138a5dfe37ca9392c0ed3722bb10

    • SHA1

      b859f2931678370ec7323284c48ee84420403dc6

    • SHA256

      f4abbf4717010d698712c6f85944d73755d0fc30a60844fc6d0c9d86822cca38

    • SHA512

      d0f92d165a455d838e9ffe83d4b8d5843ef65315ff2fe151bfebe6a09d1c8b8be842c797000fc46238a37f76b137bd6d491a84b7cd84e2412d96337cab9a6deb

    • SSDEEP

      24576:XF/Qs4a9rtQ/D5ey/A5m27P8fIeWRvtuEpjgbnvPQN5vYB9n5g9U0MOMJwPQ+3oS:XF6KNjgZwQ+33e76

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies security service

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks