General

  • Target

    XNXBot Test v5.exe

  • Size

    2.6MB

  • Sample

    240516-1erm8she46

  • MD5

    3a6417ba5ef68d3d1823cda12878d367

  • SHA1

    216a748dd2756ad28960a79775b3e13fcf0eed5f

  • SHA256

    0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25

  • SHA512

    819d2dc1d82ef61bb1b94cb0aaa8f89732e853901b5bff03ec6d48f02cf04783ef22087ad57785fd3d974a1fc0f74311832e3734f5325a37c45f672d62e20668

  • SSDEEP

    49152:UbA30H6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1BfF:Uben/V89ITPTnK1BN

Malware Config

Targets

    • Target

      XNXBot Test v5.exe

    • Size

      2.6MB

    • MD5

      3a6417ba5ef68d3d1823cda12878d367

    • SHA1

      216a748dd2756ad28960a79775b3e13fcf0eed5f

    • SHA256

      0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25

    • SHA512

      819d2dc1d82ef61bb1b94cb0aaa8f89732e853901b5bff03ec6d48f02cf04783ef22087ad57785fd3d974a1fc0f74311832e3734f5325a37c45f672d62e20668

    • SSDEEP

      49152:UbA30H6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1BfF:Uben/V89ITPTnK1BN

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies WinLogon for persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks