Analysis
- max time kernel
131s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
15/05/2024, 02:49
General
- Target 696a08079812bf0e8e1d7291f7a19770_NeikiAnalytics.exe
- Size 2.0MB
- Sample240515-da66ssdg2y
- SHA256 2ee02e61d3ec04833143d220633dfa97a01819314f7ce157ff20efd90c2fb0f0
Score
10/10
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\696a08079812bf0e8e1d7291f7a19770_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\696a08079812bf0e8e1d7291f7a19770_NeikiAnalytics.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4788-0-0x00007FFFEF2C3000-0x00007FFFEF2C5000-memory.dmp
memory/4788-1-0x0000000000900000-0x0000000000B0A000-memory.dmp
memory/4788-2-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp
memory/4788-3-0x0000000002B80000-0x0000000002B8E000-memory.dmp
memory/4788-4-0x0000000002B90000-0x0000000002B9E000-memory.dmp
memory/4788-6-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp