General

  • Target

    13479ce2adfeb68235431878761f2bd0_NeikiAnalytics

  • Size

    1.2MB

  • Sample

    240514-xv275acd35

  • MD5

    13479ce2adfeb68235431878761f2bd0

  • SHA1

    becd3db1ddb9494d64b2f8f28ca9dcfea5afdbb2

  • SHA256

    56eb43e82dc6e809762241b8c517ad95557489df9f758e5d2f4104742ca892b7

  • SHA512

    597d1bb3e5f090bd098bcf52ba37e132175e6c29161ba1e8398875c8de230ceb3efe47f88f435b639a8ec73fd3d0a559df072b0bf4b0b9e934540f58f9615785

  • SSDEEP

    24576:VR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:bJaDKf4p4UD1v

Malware Config

Targets

    • Target

      13479ce2adfeb68235431878761f2bd0_NeikiAnalytics

    • Size

      1.2MB

    • MD5

      13479ce2adfeb68235431878761f2bd0

    • SHA1

      becd3db1ddb9494d64b2f8f28ca9dcfea5afdbb2

    • SHA256

      56eb43e82dc6e809762241b8c517ad95557489df9f758e5d2f4104742ca892b7

    • SHA512

      597d1bb3e5f090bd098bcf52ba37e132175e6c29161ba1e8398875c8de230ceb3efe47f88f435b639a8ec73fd3d0a559df072b0bf4b0b9e934540f58f9615785

    • SSDEEP

      24576:VR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:bJaDKf4p4UD1v

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks