General
-
Target
CrackLauncher.exe
-
Size
34.2MB
-
Sample
240715-x5ql3svhpk
-
MD5
47459c72e16d587d72f106421f46c620
-
SHA1
784809d4e9b71f9da764d43835ff5436e80424ea
-
SHA256
64e4ba2eff7e8abd6c738c4360079a3ced0a6d22e8935c2f8216d69b178075d3
-
SHA512
a78537d5bbc8569a72d388e784b16fd280ffec1cde809e56b9785cae509daec1634d0eecfe8cc0cecae5206856c143e623f8696cce3ceccc140251e490c47bf7
-
SSDEEP
786432:ieHWdpbJx2ecXKKhhN546VkZ74qNN/X9/ao/z40wmPTsm:ihbJxJcX5hhNibZ74qNN/td0r6Tsm
Static task
static1
Behavioral task
behavioral1
Sample
CrackLauncher.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
CrackLauncher.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
CrackLauncher.exe
-
Size
34.2MB
-
MD5
47459c72e16d587d72f106421f46c620
-
SHA1
784809d4e9b71f9da764d43835ff5436e80424ea
-
SHA256
64e4ba2eff7e8abd6c738c4360079a3ced0a6d22e8935c2f8216d69b178075d3
-
SHA512
a78537d5bbc8569a72d388e784b16fd280ffec1cde809e56b9785cae509daec1634d0eecfe8cc0cecae5206856c143e623f8696cce3ceccc140251e490c47bf7
-
SSDEEP
786432:ieHWdpbJx2ecXKKhhN546VkZ74qNN/X9/ao/z40wmPTsm:ihbJxJcX5hhNibZ74qNN/td0r6Tsm
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1