General

  • Target

    d96af1f18f70dd1401179685f518b060_NeikiAnalytics

  • Size

    3.2MB

  • Sample

    240515-twjwdshf42

  • MD5

    d96af1f18f70dd1401179685f518b060

  • SHA1

    2111cbea44fe1c5af0c3bfd7b48c9de09e769f3e

  • SHA256

    cc692cb560eed095d42301dda9d9825b8b6656123b88164a9fa72724b651d0c8

  • SHA512

    5ef31420588da5afed32d8c0fc6e6dc1742927abe1658a5ffe36cc0e82794b1c03a94a7ba9e8d6d18a6fe82e1deba5c825fde442ffbe0c0e7ce8658ebc317c98

  • SSDEEP

    49152:HC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:HC0Fl8v/qXYrv5tG9uKJGAWl5N

Malware Config

Targets

    • Target

      d96af1f18f70dd1401179685f518b060_NeikiAnalytics

    • Size

      3.2MB

    • MD5

      d96af1f18f70dd1401179685f518b060

    • SHA1

      2111cbea44fe1c5af0c3bfd7b48c9de09e769f3e

    • SHA256

      cc692cb560eed095d42301dda9d9825b8b6656123b88164a9fa72724b651d0c8

    • SHA512

      5ef31420588da5afed32d8c0fc6e6dc1742927abe1658a5ffe36cc0e82794b1c03a94a7ba9e8d6d18a6fe82e1deba5c825fde442ffbe0c0e7ce8658ebc317c98

    • SSDEEP

      49152:HC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:HC0Fl8v/qXYrv5tG9uKJGAWl5N

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks