General
-
Target
3969991942bb5b6130977411ae258ab8_NeikiAnalytics
-
Size
19.4MB
-
Sample
240528-jlk1labd61
-
MD5
5eb9fd6252a47041f94daa9bb8bb7f8f
-
SHA1
f373d4d9011fb66ee729b3a0c52155aff12dd1e4
-
SHA256
a61ecbd90edbc5cc26ed5bc4ab6064ed7ae966cbf517674458d1823746df2bfd
-
SHA512
caf70f3391e5cf2d14a41ab54e0bacc7467f5bf1c9acd4907bc1a7a189298c2d5aa38b0cd5a6298371b9c1cb01d7902f140d7917f3896fd2c27780c3034a6820
-
SSDEEP
393216:b2nPPTBq8TeGnUvaeRNwm6+aQ7HjsG/i6hZPV6gWVd74dQ+2yXUX9STE0B2Xqpf:U7Bs/Nj6+njsH6/M52Q+2a+9SnwXGf
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1221847080373584144/7stbODqa-C2IH_V1s7-AaD6fECqR68YLov_s341xewFGvFGlgl7fRFcAsV3CtRNlSgzQ
Extracted
xworm
127.0.0.1:30683
operating-niger.gl.at.ply.gg:30683:30683
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28.exe
-
Size
19.8MB
-
MD5
3969991942bb5b6130977411ae258ab8
-
SHA1
c391e670488d73dc79c2acfab1e845d9c3e5227e
-
SHA256
aec009724ba208376f91cbfafd60db1e965f9016f17f14bfb3b074dde1f6ae28
-
SHA512
ce009d113cd85629cb744c0e30fecc9cb1f3bc353b546eab676604a3eec976c5f0dc60cb29b7f4841bb71bb7596128340d1b222408c9aeeb9f9671d1a1add00a
-
SSDEEP
393216:O581WtclJGQ9GnlC58mn3yJQjNKlgtcTuOYTmWYlY5nGPEy+tj7NJX:OeWgdGnlCqm3vKCTmpY5Py+r
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Umbral payload
-
Detect Xworm Payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Xworm
Xworm is a remote access trojan written in C#.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-