General

  • Target

    8b7315310f64f655192f76ee38be0f60NeikiAnalytics.exe

  • Size

    2.0MB

  • Sample

    240601-dta8gaga3t

  • MD5

    8b7315310f64f655192f76ee38be0f60

  • SHA1

    ead7c51d67763184aaeb479fb04f514a112f93da

  • SHA256

    39e9eb95baba36457a2d52c1172cd4b7135d3d3405b8f87899af5aab19774fdf

  • SHA512

    a9f2d642484714d5e32b482a53d127e9deb7e6f0ec3b4451b3bd8f658742e903b93da076fddcc8c70b6380fba5e28003b8b8afaa443452dbe6a06ad55b7308f7

  • SSDEEP

    24576:Un2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:CaTUv0jmtEttc

Malware Config

Targets

    • Target

      8b7315310f64f655192f76ee38be0f60NeikiAnalytics.exe

    • Size

      2.0MB

    • MD5

      8b7315310f64f655192f76ee38be0f60

    • SHA1

      ead7c51d67763184aaeb479fb04f514a112f93da

    • SHA256

      39e9eb95baba36457a2d52c1172cd4b7135d3d3405b8f87899af5aab19774fdf

    • SHA512

      a9f2d642484714d5e32b482a53d127e9deb7e6f0ec3b4451b3bd8f658742e903b93da076fddcc8c70b6380fba5e28003b8b8afaa443452dbe6a06ad55b7308f7

    • SSDEEP

      24576:Un2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:CaTUv0jmtEttc

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies WinLogon for persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks