General

  • Target

    1177d948403b0efc96899542aa7121d3.exe

  • Size

    3.8MB

  • Sample

    231118-ggamysbh78

  • MD5

    1177d948403b0efc96899542aa7121d3

  • SHA1

    3cd7bf300f6482728cd5f46ea07d0a0685decfc1

  • SHA256

    db356737d8940879b057bd0173aae780602b9ceb0a5790bd90e12c5cfc194088

  • SHA512

    da3239d8c283d8786d81f01badfa4f2eb787a23add947cd2ecff78b65019b2ca168198263e978e664bbacd3520489a98b7c7b0d5775b2e1571396924bcc07a11

  • SSDEEP

    98304:PuXEdPN+TIvz8Uv3gifh55G1bNc50ymOMFQ:Pc0P2ZsgKH5G1RUNMm

Malware Config

Targets

    • Target

      1177d948403b0efc96899542aa7121d3.exe

    • Size

      3.8MB

    • MD5

      1177d948403b0efc96899542aa7121d3

    • SHA1

      3cd7bf300f6482728cd5f46ea07d0a0685decfc1

    • SHA256

      db356737d8940879b057bd0173aae780602b9ceb0a5790bd90e12c5cfc194088

    • SHA512

      da3239d8c283d8786d81f01badfa4f2eb787a23add947cd2ecff78b65019b2ca168198263e978e664bbacd3520489a98b7c7b0d5775b2e1571396924bcc07a11

    • SSDEEP

      98304:PuXEdPN+TIvz8Uv3gifh55G1bNc50ymOMFQ:Pc0P2ZsgKH5G1RUNMm

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Disables Task Manager via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks