General

  • Target

    59c0a5f5446156ff9802ef5663bc0ed900e1486895f418d0cef21fc9e4849bc0_NeikiAnalytics.exe

  • Size

    2.3MB

  • Sample

    240623-lbtk4axcqh

  • MD5

    eef9509d8c9a82613a8d10aabc361510

  • SHA1

    1ba39ed54eb01ea86aa7e67605f7b4387bd3b610

  • SHA256

    59c0a5f5446156ff9802ef5663bc0ed900e1486895f418d0cef21fc9e4849bc0

  • SHA512

    79da73e0b812a5dd19f459dc7cc3df0962db3661e1f10fc5f27d44b131757b9535d04e92ccde05dab60529ff371b255cddf4028daba0e799ea12552a5ff8d3f8

  • SSDEEP

    49152:ybA3QKMsJNUcdO9Y+IcsIUSr3uOXHw0C0G/FP43:yb+hJNUcdb+IcsIDFHw0t6PK

Malware Config

Targets

    • Target

      59c0a5f5446156ff9802ef5663bc0ed900e1486895f418d0cef21fc9e4849bc0_NeikiAnalytics.exe

    • Size

      2.3MB

    • MD5

      eef9509d8c9a82613a8d10aabc361510

    • SHA1

      1ba39ed54eb01ea86aa7e67605f7b4387bd3b610

    • SHA256

      59c0a5f5446156ff9802ef5663bc0ed900e1486895f418d0cef21fc9e4849bc0

    • SHA512

      79da73e0b812a5dd19f459dc7cc3df0962db3661e1f10fc5f27d44b131757b9535d04e92ccde05dab60529ff371b255cddf4028daba0e799ea12552a5ff8d3f8

    • SSDEEP

      49152:ybA3QKMsJNUcdO9Y+IcsIUSr3uOXHw0C0G/FP43:yb+hJNUcdb+IcsIDFHw0t6PK

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks