General
-
Target
d96af1f18f70dd1401179685f518b060_NeikiAnalytics
-
Size
3.2MB
-
Sample
240515-twjwdshf42
-
MD5
d96af1f18f70dd1401179685f518b060
-
SHA1
2111cbea44fe1c5af0c3bfd7b48c9de09e769f3e
-
SHA256
cc692cb560eed095d42301dda9d9825b8b6656123b88164a9fa72724b651d0c8
-
SHA512
5ef31420588da5afed32d8c0fc6e6dc1742927abe1658a5ffe36cc0e82794b1c03a94a7ba9e8d6d18a6fe82e1deba5c825fde442ffbe0c0e7ce8658ebc317c98
-
SSDEEP
49152:HC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:HC0Fl8v/qXYrv5tG9uKJGAWl5N
Behavioral task
behavioral1
Sample
d96af1f18f70dd1401179685f518b060_NeikiAnalytics.exe
Resource
win7-20240220-en
Malware Config
Targets
-
-
Target
d96af1f18f70dd1401179685f518b060_NeikiAnalytics
-
Size
3.2MB
-
MD5
d96af1f18f70dd1401179685f518b060
-
SHA1
2111cbea44fe1c5af0c3bfd7b48c9de09e769f3e
-
SHA256
cc692cb560eed095d42301dda9d9825b8b6656123b88164a9fa72724b651d0c8
-
SHA512
5ef31420588da5afed32d8c0fc6e6dc1742927abe1658a5ffe36cc0e82794b1c03a94a7ba9e8d6d18a6fe82e1deba5c825fde442ffbe0c0e7ce8658ebc317c98
-
SSDEEP
49152:HC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:HC0Fl8v/qXYrv5tG9uKJGAWl5N
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1