General

  • Target

    RastyClient.exe

  • Size

    1.6MB

  • Sample

    240721-mvsnksydpd

  • MD5

    e97033f786a03e53c5b1f2f8f7459823

  • SHA1

    ee716af387f986b3f89eaa8f95e2e9525a7e6dc5

  • SHA256

    51803275cce1aa6e37aaa3f5cc9d28244eb27f275691254b0c916224f8cbe3f3

  • SHA512

    492f847961f8bea60b2aaa9d6200148fb0b7da4a504f3bd41c624e6698d8ae5f0ac925c612cc53b099173ca1730c8c1bd6945ca8ea58d1a472fc428220c5e8ca

  • SSDEEP

    24576:U2G/nvxW3Ww0tXNKse+i4rH9o95ONppeDZf/7wL6yz3dkoJoDvCJp88aQ:UbA30Xg4rdC/bIoDvC88P

Score
10/10

Malware Config

Targets

    • Target

      RastyClient.exe

    • Size

      1.6MB

    • MD5

      e97033f786a03e53c5b1f2f8f7459823

    • SHA1

      ee716af387f986b3f89eaa8f95e2e9525a7e6dc5

    • SHA256

      51803275cce1aa6e37aaa3f5cc9d28244eb27f275691254b0c916224f8cbe3f3

    • SHA512

      492f847961f8bea60b2aaa9d6200148fb0b7da4a504f3bd41c624e6698d8ae5f0ac925c612cc53b099173ca1730c8c1bd6945ca8ea58d1a472fc428220c5e8ca

    • SSDEEP

      24576:U2G/nvxW3Ww0tXNKse+i4rH9o95ONppeDZf/7wL6yz3dkoJoDvCJp88aQ:UbA30Xg4rdC/bIoDvC88P

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks