General
-
Target
a2076a85de5c50013fd48e423e2c2050_NeikiAnalytics
-
Size
2.9MB
-
Sample
240515-h6seqseg6v
-
MD5
a2076a85de5c50013fd48e423e2c2050
-
SHA1
4ef4d4fd4cf21287ccb37baa4fc8a4efa31b6bd6
-
SHA256
296ff7111b13564c6bffbc590f46a21188c873f95658d756c22425584453b9b6
-
SHA512
ff45a43830600f097569378af3d957346f2e66bfbf65f5a89ba592c5b90ef0759bf7a587914fb84c3406b6624c2301652ed30440cde9701d18bdf68b46cfa1a3
-
SSDEEP
49152:f4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:QDKmzjWnC8Wikx1DUN2/Uq
Behavioral task
behavioral1
Sample
a2076a85de5c50013fd48e423e2c2050_NeikiAnalytics.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
a2076a85de5c50013fd48e423e2c2050_NeikiAnalytics
-
Size
2.9MB
-
MD5
a2076a85de5c50013fd48e423e2c2050
-
SHA1
4ef4d4fd4cf21287ccb37baa4fc8a4efa31b6bd6
-
SHA256
296ff7111b13564c6bffbc590f46a21188c873f95658d756c22425584453b9b6
-
SHA512
ff45a43830600f097569378af3d957346f2e66bfbf65f5a89ba592c5b90ef0759bf7a587914fb84c3406b6624c2301652ed30440cde9701d18bdf68b46cfa1a3
-
SSDEEP
49152:f4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:QDKmzjWnC8Wikx1DUN2/Uq
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1