General

  • Target

    a8490ec288042a275cc34152e7e38e58.exe

  • Size

    1.7MB

  • Sample

    230127-xggn9sea4z

  • MD5

    a8490ec288042a275cc34152e7e38e58

  • SHA1

    55d45e8d0818b6549104b8656462125cb1ef9d46

  • SHA256

    878ca94c0a87add5a199309ba3bbb222e7cfe76f118b3f9e00f82a11c5a55682

  • SHA512

    9cae5d7b7fb1c1919849c9ff66cbdf0c709021da6147e360416c7795bd621afb4a6880ad91abce55594fbc56725dc165a7c8b4d6fca7c50c4ba60294dd971a8f

  • SSDEEP

    24576:oVvACGOfLOiwzatXNbn11rHfq+XwXwIfBnshZWU/8WT1HNg9o71rRS:oVvACGpAj11hgpJs/FUW89SV

Malware Config

Targets

    • Target

      a8490ec288042a275cc34152e7e38e58.exe

    • Size

      1.7MB

    • MD5

      a8490ec288042a275cc34152e7e38e58

    • SHA1

      55d45e8d0818b6549104b8656462125cb1ef9d46

    • SHA256

      878ca94c0a87add5a199309ba3bbb222e7cfe76f118b3f9e00f82a11c5a55682

    • SHA512

      9cae5d7b7fb1c1919849c9ff66cbdf0c709021da6147e360416c7795bd621afb4a6880ad91abce55594fbc56725dc165a7c8b4d6fca7c50c4ba60294dd971a8f

    • SSDEEP

      24576:oVvACGOfLOiwzatXNbn11rHfq+XwXwIfBnshZWU/8WT1HNg9o71rRS:oVvACGpAj11hgpJs/FUW89SV

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies WinLogon for persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

5
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks