General

  • Target

    a57378db4d26609de5f519dd2659ae60N.exe

  • Size

    784KB

  • Sample

    240721-lme7vazdpn

  • MD5

    a57378db4d26609de5f519dd2659ae60

  • SHA1

    56f0f96c01ca12792cea6b7ea0814f0f568fe095

  • SHA256

    cb667550264f5028045377419da9a935006e09b136ebe69a409a520dbf8db587

  • SHA512

    6bfa4635da5753f2713c826ade75910bd0d8488915c8b80e5893b52c7c8696538edb5d4a4fba68636b1a92de6d487a184fabafb945ee35eecb6015bf4163cf33

  • SSDEEP

    12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2

Malware Config

Targets

    • Target

      a57378db4d26609de5f519dd2659ae60N.exe

    • Size

      784KB

    • MD5

      a57378db4d26609de5f519dd2659ae60

    • SHA1

      56f0f96c01ca12792cea6b7ea0814f0f568fe095

    • SHA256

      cb667550264f5028045377419da9a935006e09b136ebe69a409a520dbf8db587

    • SHA512

      6bfa4635da5753f2713c826ade75910bd0d8488915c8b80e5893b52c7c8696538edb5d4a4fba68636b1a92de6d487a184fabafb945ee35eecb6015bf4163cf33

    • SSDEEP

      12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks