General

  • Target

    0b222b4a899979ddf52b634b82368a08.exe

  • Size

    50.0MB

  • Sample

    240530-bc823ahe48

  • MD5

    0b222b4a899979ddf52b634b82368a08

  • SHA1

    a07b66cde199d96efb99718b9b7d365036350c29

  • SHA256

    faf82dcfbb2ffa2a94047a5e017d95e9757aa3420af8cebcef6c8933cde2c295

  • SHA512

    70c8101223e1e5c5b9aec69d756469ba2ca2370cb92bdc28d4990174f9c2f3d93cc1512049d650fa31f1993ddef49da98007552331a05332741497df5b063e51

  • SSDEEP

    1572864:WK7C5EpF9PX7uC/mVLJhbWnRdrF10hWNYP02oa:WK7CMrLv0JhbWT/mXs2

Malware Config

Targets

    • Target

      0b222b4a899979ddf52b634b82368a08.exe

    • Size

      50.0MB

    • MD5

      0b222b4a899979ddf52b634b82368a08

    • SHA1

      a07b66cde199d96efb99718b9b7d365036350c29

    • SHA256

      faf82dcfbb2ffa2a94047a5e017d95e9757aa3420af8cebcef6c8933cde2c295

    • SHA512

      70c8101223e1e5c5b9aec69d756469ba2ca2370cb92bdc28d4990174f9c2f3d93cc1512049d650fa31f1993ddef49da98007552331a05332741497df5b063e51

    • SSDEEP

      1572864:WK7C5EpF9PX7uC/mVLJhbWnRdrF10hWNYP02oa:WK7CMrLv0JhbWT/mXs2

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies WinLogon for persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks