Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 00:39

General

  • Target

    655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe

  • Size

    2.0MB

  • MD5

    655dc7774cdf944db4ff785f6d601030

  • SHA1

    66399adc518f27a64dc29400bf29f1e2968a4561

  • SHA256

    86b266382f4e29072c303ce53409567e08d27f5f9a7af72a9af55922a4f2852a

  • SHA512

    bbfa3b4840c1a341d8e5435104935a6bc4098bf671e4e6fc1089b30c5ede745d848df346a59149f34ff763535dba6dff778155525c3a7bbf43a9c9e782cdb840

  • SSDEEP

    49152:zrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:zdxVJC9UqRzsu+8N

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2052-0-0x000007FEF53C3000-0x000007FEF53C4000-memory.dmp

    Filesize

    4KB

  • memory/2052-1-0x0000000000E30000-0x000000000103A000-memory.dmp

    Filesize

    2.0MB

  • memory/2052-2-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

    Filesize

    9.9MB

  • memory/2052-3-0x00000000004C0000-0x00000000004CE000-memory.dmp

    Filesize

    56KB

  • memory/2052-4-0x00000000004D0000-0x00000000004DE000-memory.dmp

    Filesize

    56KB

  • memory/2052-5-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

    Filesize

    9.9MB