General

  • Target

    a1d05206520518a47f710e7197bbc336.exe

  • Size

    1.5MB

  • Sample

    230602-lbbehsbb51

  • MD5

    a1d05206520518a47f710e7197bbc336

  • SHA1

    270ac60027ac01b78139bec3a6fe54f702c4fe96

  • SHA256

    374eba5495779dc24974bb881e0c3f298861a91d88d710da4f684bf8a2a01fe6

  • SHA512

    6164910de359dd7f9ad12e75c1ea170ff5fb313598da249c12888a100cd01e3888bbea25240a7924ea825147a7979b0b941e9d8916a322dbb3846c077959921a

  • SSDEEP

    24576:YW3QhwWwORHtx07i/85O8q9Fx7hFsf1gj7xN9sKrogXMAGqo3K6L29ufIOT0Gj:YW3QNRH/07imOljZhFsf1s9ZkgXZkKxC

Score
10/10

Malware Config

Targets

    • Target

      a1d05206520518a47f710e7197bbc336.exe

    • Size

      1.5MB

    • MD5

      a1d05206520518a47f710e7197bbc336

    • SHA1

      270ac60027ac01b78139bec3a6fe54f702c4fe96

    • SHA256

      374eba5495779dc24974bb881e0c3f298861a91d88d710da4f684bf8a2a01fe6

    • SHA512

      6164910de359dd7f9ad12e75c1ea170ff5fb313598da249c12888a100cd01e3888bbea25240a7924ea825147a7979b0b941e9d8916a322dbb3846c077959921a

    • SSDEEP

      24576:YW3QhwWwORHtx07i/85O8q9Fx7hFsf1gj7xN9sKrogXMAGqo3K6L29ufIOT0Gj:YW3QNRH/07imOljZhFsf1s9ZkgXZkKxC

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Tasks