General

  • Target

    131604f5f6612d1f2973e76bedcdd7f1d78deda8c4465eb28f4dfda1051a3fa3.exe

  • Size

    1.2MB

  • Sample

    240324-cfq64aag7t

  • MD5

    d7a0ca18ae95c63d25af6782b7bd6b8d

  • SHA1

    86450a088d627ab64129c4dc34a824da3ee4b561

  • SHA256

    131604f5f6612d1f2973e76bedcdd7f1d78deda8c4465eb28f4dfda1051a3fa3

  • SHA512

    9714dcca024cd2780fb28ad9b12280e6ad4b0aca3b6650e0137c80c4b2b29db68add4b5085fa2ddf49e780a470b936b3bb74282eb3c4246661f6bd60a7688274

  • SSDEEP

    24576:U2G/nvxW3Ww0txzb2+Jh6UN0AbIkKlAgHJOsiCWzD6z+47:UbA30B5rbNlILj1hCc

Malware Config

Targets

    • Target

      131604f5f6612d1f2973e76bedcdd7f1d78deda8c4465eb28f4dfda1051a3fa3.exe

    • Size

      1.2MB

    • MD5

      d7a0ca18ae95c63d25af6782b7bd6b8d

    • SHA1

      86450a088d627ab64129c4dc34a824da3ee4b561

    • SHA256

      131604f5f6612d1f2973e76bedcdd7f1d78deda8c4465eb28f4dfda1051a3fa3

    • SHA512

      9714dcca024cd2780fb28ad9b12280e6ad4b0aca3b6650e0137c80c4b2b29db68add4b5085fa2ddf49e780a470b936b3bb74282eb3c4246661f6bd60a7688274

    • SSDEEP

      24576:U2G/nvxW3Ww0txzb2+Jh6UN0AbIkKlAgHJOsiCWzD6z+47:UbA30B5rbNlILj1hCc

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks