General

  • Target

    131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe

  • Size

    1.6MB

  • Sample

    240714-kmncsawdkf

  • MD5

    1849f89a807de47190139035f6148366

  • SHA1

    0e23f3cfc246483f5dd17815fea3d5011f6611c7

  • SHA256

    131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac

  • SHA512

    49398d7a4f763caf39385945abbc3c028be655fa4d89f05b638708f2e1d790c94deee45e3fd14c7c34acba71c037f6d155514c69342a2257f1a21c084488d154

  • SSDEEP

    24576:05YLUm55/+Bo4L+n5iSFjw0bAtnG/E4yUzJu/iPenTjabqlfii9m2JKSTMGsWq1x:05o52O4LCBinG/hXuGkSGKgy

Malware Config

Targets

    • Target

      131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe

    • Size

      1.6MB

    • MD5

      1849f89a807de47190139035f6148366

    • SHA1

      0e23f3cfc246483f5dd17815fea3d5011f6611c7

    • SHA256

      131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac

    • SHA512

      49398d7a4f763caf39385945abbc3c028be655fa4d89f05b638708f2e1d790c94deee45e3fd14c7c34acba71c037f6d155514c69342a2257f1a21c084488d154

    • SSDEEP

      24576:05YLUm55/+Bo4L+n5iSFjw0bAtnG/E4yUzJu/iPenTjabqlfii9m2JKSTMGsWq1x:05o52O4LCBinG/hXuGkSGKgy

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks