General
-
Target
dc4a687b17405db35530af6aa40cd2b0_NeikiAnalytics
-
Size
3.2MB
-
Sample
240516-ndvbhshh5t
-
MD5
dc4a687b17405db35530af6aa40cd2b0
-
SHA1
acaeb4c374b0e1b55e7891cf5e20498e3b9cdd88
-
SHA256
3f40b000017400edfb42a468c94ce03625a7003a238fae61929f20ee35c67f44
-
SHA512
620ce4b0a8673598dd5975a8b304eeaff6eab85084a39d5a46efcf3b209b8f51a1eb8d81d5c6709e1ec5e67b913b9534ff440d5784aa03662cbdabb105a47487
-
SSDEEP
49152:vC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:vC0Fl8v/qXYrv5tG9uKJGAWl5N
Behavioral task
behavioral1
Sample
dc4a687b17405db35530af6aa40cd2b0_NeikiAnalytics.exe
Resource
win7-20240419-en
Malware Config
Targets
-
-
Target
dc4a687b17405db35530af6aa40cd2b0_NeikiAnalytics
-
Size
3.2MB
-
MD5
dc4a687b17405db35530af6aa40cd2b0
-
SHA1
acaeb4c374b0e1b55e7891cf5e20498e3b9cdd88
-
SHA256
3f40b000017400edfb42a468c94ce03625a7003a238fae61929f20ee35c67f44
-
SHA512
620ce4b0a8673598dd5975a8b304eeaff6eab85084a39d5a46efcf3b209b8f51a1eb8d81d5c6709e1ec5e67b913b9534ff440d5784aa03662cbdabb105a47487
-
SSDEEP
49152:vC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:vC0Fl8v/qXYrv5tG9uKJGAWl5N
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1