Analysis

  • max time kernel
    130s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 03:24

General

  • Target

    7506996457b1948a43dac325054a9220NeikiAnalytics.exe

  • Size

    571KB

  • MD5

    7506996457b1948a43dac325054a9220

  • SHA1

    05bf70b7f278744163528e00eb6e9cfb0412ec19

  • SHA256

    c180024033746ce3e9dca10e6d5ca7a16a1ffd893cd535a8af45f533b70100fd

  • SHA512

    f73c7314101f8171201b61532d607c1d916719ebcea0dbc46c89b8bb71e548c02da5934a8d9582bc2d517d3c2e81d3fbd100fd5758aef351ed678a3ad5cb14bf

  • SSDEEP

    12288:R+2N7ag2NdAXGihipZdxnli8uaS9XYiT0P83P1tGb0v72bEFix:R+2J2li0RxnlKaUh7id

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7506996457b1948a43dac325054a9220NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7506996457b1948a43dac325054a9220NeikiAnalytics.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4044-0-0x0000000000A80000-0x0000000000B16000-memory.dmp
    Filesize

    600KB

  • memory/4044-1-0x00007FFCBB043000-0x00007FFCBB045000-memory.dmp
    Filesize

    8KB

  • memory/4044-2-0x0000000002C20000-0x0000000002C2E000-memory.dmp
    Filesize

    56KB

  • memory/4044-3-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmp
    Filesize

    10.8MB

  • memory/4044-5-0x00007FFCBB040000-0x00007FFCBBB01000-memory.dmp
    Filesize

    10.8MB