General

  • Target

    Modrinth_Installer.exe

  • Size

    6.4MB

  • Sample

    240712-1v56kathpa

  • MD5

    1dba4e07fc018ea2f1d40969dbba02e6

  • SHA1

    e4b6c58846286c6f3dc5eb51cdb3086a78f25606

  • SHA256

    a404a3f5f652da82f09f870d81476a452cae36f4a1378f90ec8ff06d6691e8cb

  • SHA512

    7add82374742df98c05913bc4c5a8a32fbadc44aa29c4c97f14f5a0ea1887fb04e4385a4a87d958128f5a1f74df449e5164ed5603089a06b40621ced5c57d3c2

  • SSDEEP

    98304:NbjIgtzNT+6HE4ThcGalSS9d+udj3mYcCqQcgT3XV8tEbETvsDHaLqV710ZZ9rPE:NfI+/HMlS2JxmYcmcg7XGqb6Msq51GPE

Malware Config

Targets

    • Target

      Modrinth_Installer.exe

    • Size

      6.4MB

    • MD5

      1dba4e07fc018ea2f1d40969dbba02e6

    • SHA1

      e4b6c58846286c6f3dc5eb51cdb3086a78f25606

    • SHA256

      a404a3f5f652da82f09f870d81476a452cae36f4a1378f90ec8ff06d6691e8cb

    • SHA512

      7add82374742df98c05913bc4c5a8a32fbadc44aa29c4c97f14f5a0ea1887fb04e4385a4a87d958128f5a1f74df449e5164ed5603089a06b40621ced5c57d3c2

    • SSDEEP

      98304:NbjIgtzNT+6HE4ThcGalSS9d+udj3mYcCqQcgT3XV8tEbETvsDHaLqV710ZZ9rPE:NfI+/HMlS2JxmYcmcg7XGqb6Msq51GPE

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks