General
-
Target
b6c83df257a00210c12b42d28a5df730_NeikiAnalytics
-
Size
3.2MB
-
Sample
240515-k3qg3sad3t
-
MD5
b6c83df257a00210c12b42d28a5df730
-
SHA1
67a993a3c4547e8442f767575dafdbfe018ec0e4
-
SHA256
8fdd38ee81442567732265fa944a19a51a26ec1254e8d2a54e41d254a52a35d6
-
SHA512
1c0bdbae29e9761260b3f9284d41be1b63c921399e7e1822c5c725d9811bea555b64fd311ab8e86634b36fdfa381e686fe087b480de9cf958a4f944556f5f60c
-
SSDEEP
49152:vC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:vC0Fl8v/qXYrv5tG9uKJGAWl5N
Behavioral task
behavioral1
Sample
b6c83df257a00210c12b42d28a5df730_NeikiAnalytics.exe
Resource
win7-20240508-en
Malware Config
Targets
-
-
Target
b6c83df257a00210c12b42d28a5df730_NeikiAnalytics
-
Size
3.2MB
-
MD5
b6c83df257a00210c12b42d28a5df730
-
SHA1
67a993a3c4547e8442f767575dafdbfe018ec0e4
-
SHA256
8fdd38ee81442567732265fa944a19a51a26ec1254e8d2a54e41d254a52a35d6
-
SHA512
1c0bdbae29e9761260b3f9284d41be1b63c921399e7e1822c5c725d9811bea555b64fd311ab8e86634b36fdfa381e686fe087b480de9cf958a4f944556f5f60c
-
SSDEEP
49152:vC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:vC0Fl8v/qXYrv5tG9uKJGAWl5N
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1