General

  • Target

    4702efeca1e1567682de542576c87263.exe

  • Size

    1.2MB

  • Sample

    231209-hw4d9aggd5

  • MD5

    4702efeca1e1567682de542576c87263

  • SHA1

    0a4396509d1778b815836a81ba3ed4d5f037b66b

  • SHA256

    f911d63c252ce10ceb704ab2b010d29cd8d37faef41f057a536a0c9412861e4c

  • SHA512

    6fafd46c1107dfe35f07e103ca9f65c2a79027550667e2073e95e2876cf63bc16289982f66b52f2485a39fd680799c8943ff493adde9aae08dec6bd287eb4449

  • SSDEEP

    24576:CkG6Pmd6hGQFgldYLg0A11r+slyxMrgRzWnAZ8F6:CktuldiYV+qjrgRfS

Score
10/10

Malware Config

Targets

    • Target

      4702efeca1e1567682de542576c87263.exe

    • Size

      1.2MB

    • MD5

      4702efeca1e1567682de542576c87263

    • SHA1

      0a4396509d1778b815836a81ba3ed4d5f037b66b

    • SHA256

      f911d63c252ce10ceb704ab2b010d29cd8d37faef41f057a536a0c9412861e4c

    • SHA512

      6fafd46c1107dfe35f07e103ca9f65c2a79027550667e2073e95e2876cf63bc16289982f66b52f2485a39fd680799c8943ff493adde9aae08dec6bd287eb4449

    • SSDEEP

      24576:CkG6Pmd6hGQFgldYLg0A11r+slyxMrgRzWnAZ8F6:CktuldiYV+qjrgRfS

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks