Analysis
- max time kernel
93s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
26/05/2024, 01:02
General
- Target 447f26821b8eda78ef3bfe2cb25e12e0_NeikiAnalytics.exe
- Size 1.5MB
- Sample240526-bd91rahf77
- SHA256 2100e79f392d11633cb98448e1f653abad8bb85882f5533a1e560ded7b3f3aac
Score
10/10
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\447f26821b8eda78ef3bfe2cb25e12e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\447f26821b8eda78ef3bfe2cb25e12e0_NeikiAnalytics.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3180-0-0x00007FFE14C73000-0x00007FFE14C75000-memory.dmp
memory/3180-1-0x00000000005E0000-0x000000000076C000-memory.dmp
memory/3180-2-0x00007FFE14C70000-0x00007FFE15731000-memory.dmp
memory/3180-3-0x0000000001030000-0x000000000103E000-memory.dmp
memory/3180-4-0x0000000001040000-0x000000000104E000-memory.dmp
memory/3180-6-0x00007FFE14C70000-0x00007FFE15731000-memory.dmp