General

  • Target

    6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606.exe

  • Size

    2.3MB

  • Sample

    240512-kq693agg8x

  • MD5

    1e44441cdb7cc1903964568a4518241d

  • SHA1

    ce24ced9c67a214eaa57af0cb9ca6248ec2da1cf

  • SHA256

    6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606

  • SHA512

    955a7ffc7951c362043d1cb048a00efc9752a23a3485721c9b5d87cde0b8514c18a28efc1b9019d211d5e766e79b809ba35ffbe3c7b821c51823be014248529c

  • SSDEEP

    49152:XNo6zhi1OEqW4gINlnI9JpWZhKGLK71HAx5ZqsdLC+HK:XivOErINl9K0px731HK

Score
10/10

Malware Config

Targets

    • Target

      6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606.exe

    • Size

      2.3MB

    • MD5

      1e44441cdb7cc1903964568a4518241d

    • SHA1

      ce24ced9c67a214eaa57af0cb9ca6248ec2da1cf

    • SHA256

      6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606

    • SHA512

      955a7ffc7951c362043d1cb048a00efc9752a23a3485721c9b5d87cde0b8514c18a28efc1b9019d211d5e766e79b809ba35ffbe3c7b821c51823be014248529c

    • SSDEEP

      49152:XNo6zhi1OEqW4gINlnI9JpWZhKGLK71HAx5ZqsdLC+HK:XivOErINl9K0px731HK

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks