General

  • Target

    d6dbbcf07d7bd493643c1b057c1c544da0a5427537725c0580dc309148bd23aa.exe

  • Size

    879KB

  • Sample

    240618-xwpy7aygjr

  • MD5

    566fd5dcb2b546a8e3dd8a66247ca5c7

  • SHA1

    897e053d02448b18d9b2783570f1adad93ebd275

  • SHA256

    d6dbbcf07d7bd493643c1b057c1c544da0a5427537725c0580dc309148bd23aa

  • SHA512

    0b4aab955dcc5e96807740e075b3195aece3cadcff7339591709fe6ced6c68e6bb09cf68074fe721a5197e735b7f04f8bd2b2eaf41cd11c525f674488e942dfe

  • SSDEEP

    12288:4tfWS7JG98Rcvq4hyqwX270JRnonN1WHsaQk2Dz9LL6kThkoKcf5J6aVB:bSY98Rce270JRnonfjDY7O5J6a7

Score
10/10

Malware Config

Targets

    • Target

      d6dbbcf07d7bd493643c1b057c1c544da0a5427537725c0580dc309148bd23aa.exe

    • Size

      879KB

    • MD5

      566fd5dcb2b546a8e3dd8a66247ca5c7

    • SHA1

      897e053d02448b18d9b2783570f1adad93ebd275

    • SHA256

      d6dbbcf07d7bd493643c1b057c1c544da0a5427537725c0580dc309148bd23aa

    • SHA512

      0b4aab955dcc5e96807740e075b3195aece3cadcff7339591709fe6ced6c68e6bb09cf68074fe721a5197e735b7f04f8bd2b2eaf41cd11c525f674488e942dfe

    • SSDEEP

      12288:4tfWS7JG98Rcvq4hyqwX270JRnonN1WHsaQk2Dz9LL6kThkoKcf5J6aVB:bSY98Rce270JRnonfjDY7O5J6a7

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks