General
-
Target
6e6d1ad54e0251fc34d00124b88affa0_NeikiAnalytics.exe
-
Size
1.0MB
-
Sample
240531-agmh7age33
-
MD5
6e6d1ad54e0251fc34d00124b88affa0
-
SHA1
d72bde7e46ccd54993a643bee71a9060528fde92
-
SHA256
5141dcb8c1e87ca1dff44d7bb2fedc5ab4755e38d53a60ea0871199b05415b30
-
SHA512
0c7aae7a7ece2dd04b3dca7f8b4eb9b8cb40266a2f61204c8a69cc62d641ad5968e421dadcb511243a2689e9833f83f5f09a038c4c03e020703eaacf46e7f9a9
-
SSDEEP
12288:fubxAa9sUFxZ8oq7URPvyKBozWeL+vSgmtjJcDVrCTZSXlVB0mGEB0aNN/cPUeWl:A9sUFxZq7URPt6RL6nBrEZUjGE/L8YZ
Behavioral task
behavioral1
Sample
6e6d1ad54e0251fc34d00124b88affa0_NeikiAnalytics.exe
Resource
win7-20231129-en
Malware Config
Targets
-
-
Target
6e6d1ad54e0251fc34d00124b88affa0_NeikiAnalytics.exe
-
Size
1.0MB
-
MD5
6e6d1ad54e0251fc34d00124b88affa0
-
SHA1
d72bde7e46ccd54993a643bee71a9060528fde92
-
SHA256
5141dcb8c1e87ca1dff44d7bb2fedc5ab4755e38d53a60ea0871199b05415b30
-
SHA512
0c7aae7a7ece2dd04b3dca7f8b4eb9b8cb40266a2f61204c8a69cc62d641ad5968e421dadcb511243a2689e9833f83f5f09a038c4c03e020703eaacf46e7f9a9
-
SSDEEP
12288:fubxAa9sUFxZ8oq7URPvyKBozWeL+vSgmtjJcDVrCTZSXlVB0mGEB0aNN/cPUeWl:A9sUFxZq7URPt6RL6nBrEZUjGE/L8YZ
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1