Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 03:24

General

  • Target

    7506996457b1948a43dac325054a9220NeikiAnalytics.exe

  • Size

    571KB

  • MD5

    7506996457b1948a43dac325054a9220

  • SHA1

    05bf70b7f278744163528e00eb6e9cfb0412ec19

  • SHA256

    c180024033746ce3e9dca10e6d5ca7a16a1ffd893cd535a8af45f533b70100fd

  • SHA512

    f73c7314101f8171201b61532d607c1d916719ebcea0dbc46c89b8bb71e548c02da5934a8d9582bc2d517d3c2e81d3fbd100fd5758aef351ed678a3ad5cb14bf

  • SSDEEP

    12288:R+2N7ag2NdAXGihipZdxnli8uaS9XYiT0P83P1tGb0v72bEFix:R+2J2li0RxnlKaUh7id

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7506996457b1948a43dac325054a9220NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7506996457b1948a43dac325054a9220NeikiAnalytics.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3060-0-0x000007FEF5AD3000-0x000007FEF5AD4000-memory.dmp
    Filesize

    4KB

  • memory/3060-1-0x0000000000330000-0x00000000003C6000-memory.dmp
    Filesize

    600KB

  • memory/3060-2-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp
    Filesize

    9.9MB

  • memory/3060-3-0x00000000002D0000-0x00000000002DE000-memory.dmp
    Filesize

    56KB

  • memory/3060-4-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp
    Filesize

    9.9MB