General
-
Target
XNXBot Test v5.exe
-
Size
2.6MB
-
Sample
240516-1erm8she46
-
MD5
3a6417ba5ef68d3d1823cda12878d367
-
SHA1
216a748dd2756ad28960a79775b3e13fcf0eed5f
-
SHA256
0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25
-
SHA512
819d2dc1d82ef61bb1b94cb0aaa8f89732e853901b5bff03ec6d48f02cf04783ef22087ad57785fd3d974a1fc0f74311832e3734f5325a37c45f672d62e20668
-
SSDEEP
49152:UbA30H6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1BfF:Uben/V89ITPTnK1BN
Behavioral task
behavioral1
Sample
XNXBot Test v5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
XNXBot Test v5.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
XNXBot Test v5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
XNXBot Test v5.exe
Resource
win11-20240508-en
Malware Config
Targets
-
-
Target
XNXBot Test v5.exe
-
Size
2.6MB
-
MD5
3a6417ba5ef68d3d1823cda12878d367
-
SHA1
216a748dd2756ad28960a79775b3e13fcf0eed5f
-
SHA256
0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25
-
SHA512
819d2dc1d82ef61bb1b94cb0aaa8f89732e853901b5bff03ec6d48f02cf04783ef22087ad57785fd3d974a1fc0f74311832e3734f5325a37c45f672d62e20668
-
SSDEEP
49152:UbA30H6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1BfF:Uben/V89ITPTnK1BN
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1