General

  • Target

    d95634ea71d7354e81c6ffe04b237f974c6e4310d4a2e87693570859b809004d.exe

  • Size

    827KB

  • Sample

    240618-xw68gaygkn

  • MD5

    486a2f40ef1eca02465ef2696f805944

  • SHA1

    d66c2c4b3c579d7f41d13adc32af5b2edad54f29

  • SHA256

    d95634ea71d7354e81c6ffe04b237f974c6e4310d4a2e87693570859b809004d

  • SHA512

    a78c5de3b9551388031aff6aa22b08776d7284fe13228388d1cf4531a5fb105d54b5cdb6a2a966ef6475c23f6ccc4638c7569ad003f5109dfb9a85f735605fb8

  • SSDEEP

    12288:zeUn11/jdZPkCcGqxKVklcxPAHBcKFvXeo3LHlq5R1GUQttR:ze61/jdZJxqxKVucxYf9XNq5R1GUG/

Malware Config

Targets

    • Target

      d95634ea71d7354e81c6ffe04b237f974c6e4310d4a2e87693570859b809004d.exe

    • Size

      827KB

    • MD5

      486a2f40ef1eca02465ef2696f805944

    • SHA1

      d66c2c4b3c579d7f41d13adc32af5b2edad54f29

    • SHA256

      d95634ea71d7354e81c6ffe04b237f974c6e4310d4a2e87693570859b809004d

    • SHA512

      a78c5de3b9551388031aff6aa22b08776d7284fe13228388d1cf4531a5fb105d54b5cdb6a2a966ef6475c23f6ccc4638c7569ad003f5109dfb9a85f735605fb8

    • SSDEEP

      12288:zeUn11/jdZPkCcGqxKVklcxPAHBcKFvXeo3LHlq5R1GUQttR:ze61/jdZJxqxKVucxYf9XNq5R1GUG/

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Modifies WinLogon for persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks