General

  • Target

    24e4452c2fa32b490d57b57c307b8c2d.exe

  • Size

    2.6MB

  • Sample

    220925-cxejmachb2

  • MD5

    24e4452c2fa32b490d57b57c307b8c2d

  • SHA1

    99570080bedc40498310a7044a47110a38637721

  • SHA256

    1c2e46d685fdf5ee89fe9193e0ff0bf6dc7088014c29fe51f31e4e5613876eb6

  • SHA512

    5a911f3046f58d58f2bbf3343965d46fe7d913d8ebb30488016cf6ff60ee307d8c9bc339b91b18dfe9e9e74f6f94b04c0ade7c1165709bf83149cf1c337d3f13

  • SSDEEP

    49152:+pTn80rAHkSrvT7yEBpojAGw3fo+5D0gRbfGNW8UlbSpDCP2XF:+ZpktrvTOqp2Nw3L0gRbfGI8sepeu1

Malware Config

Targets

    • Target

      24e4452c2fa32b490d57b57c307b8c2d.exe

    • Size

      2.6MB

    • MD5

      24e4452c2fa32b490d57b57c307b8c2d

    • SHA1

      99570080bedc40498310a7044a47110a38637721

    • SHA256

      1c2e46d685fdf5ee89fe9193e0ff0bf6dc7088014c29fe51f31e4e5613876eb6

    • SHA512

      5a911f3046f58d58f2bbf3343965d46fe7d913d8ebb30488016cf6ff60ee307d8c9bc339b91b18dfe9e9e74f6f94b04c0ade7c1165709bf83149cf1c337d3f13

    • SSDEEP

      49152:+pTn80rAHkSrvT7yEBpojAGw3fo+5D0gRbfGNW8UlbSpDCP2XF:+ZpktrvTOqp2Nw3L0gRbfGI8sepeu1

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks