Analysis

  • max time kernel
    136s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 00:39

General

  • Target

    655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe

  • Size

    2.0MB

  • MD5

    655dc7774cdf944db4ff785f6d601030

  • SHA1

    66399adc518f27a64dc29400bf29f1e2968a4561

  • SHA256

    86b266382f4e29072c303ce53409567e08d27f5f9a7af72a9af55922a4f2852a

  • SHA512

    bbfa3b4840c1a341d8e5435104935a6bc4098bf671e4e6fc1089b30c5ede745d848df346a59149f34ff763535dba6dff778155525c3a7bbf43a9c9e782cdb840

  • SSDEEP

    49152:zrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:zdxVJC9UqRzsu+8N

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\655dc7774cdf944db4ff785f6d601030_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2940-0-0x00007FFCBB043000-0x00007FFCBB045000-memory.dmp

    Filesize

    8KB

  • memory/2940-1-0x0000000000EA0000-0x00000000010AA000-memory.dmp

    Filesize

    2.0MB

  • memory/2940-2-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmp

    Filesize

    10.8MB

  • memory/2940-3-0x0000000003240000-0x000000000324E000-memory.dmp

    Filesize

    56KB

  • memory/2940-4-0x000000001BCC0000-0x000000001BCCE000-memory.dmp

    Filesize

    56KB

  • memory/2940-6-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmp

    Filesize

    10.8MB