General

  • Target

    RuntimeBroker.exe

  • Size

    829KB

  • Sample

    240712-zqp34szcrl

  • MD5

    fe544d94bd84fbc7713b7c033b9909a0

  • SHA1

    a055c525f23ef2d479a8a6996e75536ba0545a22

  • SHA256

    fafd59661dd0865692d2793d9ae0cb4f4a62e06378757fb7eb96b5716fe07c35

  • SHA512

    85d17251ece1653fa3054c071f7b3e9b5a2b17ad9beb55e4c61051bd3290ab8171940773e608a31acd4689214ee3afbcce8f9182a6d6c851790482d37093cdf5

  • SSDEEP

    12288:T7KTp23CjWGKMUAdqxB6StENMbAZw1WHxcpicf3Un8IGqS:G23vuUxB6StjEw1eaiSU8rN

Score
10/10

Malware Config

Targets

    • Target

      RuntimeBroker.exe

    • Size

      829KB

    • MD5

      fe544d94bd84fbc7713b7c033b9909a0

    • SHA1

      a055c525f23ef2d479a8a6996e75536ba0545a22

    • SHA256

      fafd59661dd0865692d2793d9ae0cb4f4a62e06378757fb7eb96b5716fe07c35

    • SHA512

      85d17251ece1653fa3054c071f7b3e9b5a2b17ad9beb55e4c61051bd3290ab8171940773e608a31acd4689214ee3afbcce8f9182a6d6c851790482d37093cdf5

    • SSDEEP

      12288:T7KTp23CjWGKMUAdqxB6StENMbAZw1WHxcpicf3Un8IGqS:G23vuUxB6StjEw1eaiSU8rN

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks