Analysis
-
max time kernel
136s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 00:39
Behavioral task
behavioral1
Sample
655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe
-
Size
2.0MB
-
MD5
655dc7774cdf944db4ff785f6d601030
-
SHA1
66399adc518f27a64dc29400bf29f1e2968a4561
-
SHA256
86b266382f4e29072c303ce53409567e08d27f5f9a7af72a9af55922a4f2852a
-
SHA512
bbfa3b4840c1a341d8e5435104935a6bc4098bf671e4e6fc1089b30c5ede745d848df346a59149f34ff763535dba6dff778155525c3a7bbf43a9c9e782cdb840
-
SSDEEP
49152:zrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:zdxVJC9UqRzsu+8N
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule behavioral2/memory/2940-1-0x0000000000EA0000-0x00000000010AA000-memory.dmp dcrat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2940 655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe