Analysis
- max time kernel
129s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
27/05/2024, 23:17
General
- Target 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a_NeikiAnalytics.exe
- Size 1.1MB
- Sample240527-29pb2aeg79
- SHA256 267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a
Score
10/10
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2708-1-0x00007FF8F5A83000-0x00007FF8F5A85000-memory.dmp
memory/2708-0-0x0000000000E80000-0x0000000000FA4000-memory.dmp
memory/2708-2-0x00007FF8F5A80000-0x00007FF8F6541000-memory.dmp
memory/2708-4-0x000000001C260000-0x000000001C2B0000-memory.dmp
memory/2708-3-0x0000000003120000-0x000000000313C000-memory.dmp
memory/2708-5-0x000000001BAC0000-0x000000001BAD6000-memory.dmp
memory/2708-7-0x00007FF8F5A80000-0x00007FF8F6541000-memory.dmp