General
-
Target
a8afc525e8ae9a9c34f01e2efb7fdab0_NeikiAnalytics
-
Size
2.9MB
-
Sample
240516-gh4mesee7w
-
MD5
a8afc525e8ae9a9c34f01e2efb7fdab0
-
SHA1
6e519caf5546a9c89e62ec00fc11d78ef2fbfb6d
-
SHA256
4123eccc2d223d14ab820f328e26e109a0a6fa4a58648122fbc0fa352d242836
-
SHA512
d0747c7bfba0dff9e8d3d98d4912653006b91ac5bb63493bef05116ba2282d1daeaad2c24958ddb96623172a12bdffa77be014e08537fedde295e90bffd37b4d
-
SSDEEP
49152:/4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:wDKmzjWnC8Wikx1DUN2/Uq
Behavioral task
behavioral1
Sample
a8afc525e8ae9a9c34f01e2efb7fdab0_NeikiAnalytics.exe
Resource
win7-20240508-en
Malware Config
Targets
-
-
Target
a8afc525e8ae9a9c34f01e2efb7fdab0_NeikiAnalytics
-
Size
2.9MB
-
MD5
a8afc525e8ae9a9c34f01e2efb7fdab0
-
SHA1
6e519caf5546a9c89e62ec00fc11d78ef2fbfb6d
-
SHA256
4123eccc2d223d14ab820f328e26e109a0a6fa4a58648122fbc0fa352d242836
-
SHA512
d0747c7bfba0dff9e8d3d98d4912653006b91ac5bb63493bef05116ba2282d1daeaad2c24958ddb96623172a12bdffa77be014e08537fedde295e90bffd37b4d
-
SSDEEP
49152:/4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:wDKmzjWnC8Wikx1DUN2/Uq
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1