Analysis
- max time kernel
91s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
31/05/2024, 21:43
General
- Target 80d60545521be47b95c73a6779ef90e0NeikiAnalytics.exe
- Size 2.0MB
- Sample240531-1lay3afc86
- SHA256 759d8cc4f58b382d5e17a9744bc7b86781dd58704af341bcc9e7e859a81303fe
Score
10/10
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80d60545521be47b95c73a6779ef90e0NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\80d60545521be47b95c73a6779ef90e0NeikiAnalytics.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2732-0-0x00007FFE4B143000-0x00007FFE4B145000-memory.dmp
memory/2732-1-0x00000000002C0000-0x00000000004CA000-memory.dmp
memory/2732-2-0x00007FFE4B140000-0x00007FFE4BC01000-memory.dmp
memory/2732-3-0x0000000002540000-0x000000000254E000-memory.dmp
memory/2732-4-0x0000000002550000-0x000000000255E000-memory.dmp
memory/2732-6-0x00007FFE4B140000-0x00007FFE4BC01000-memory.dmp