General

  • Target

    865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a

  • Size

    784KB

  • Sample

    240722-3r77vsvepa

  • MD5

    46a0e2b153610307b9e60b7a799e452e

  • SHA1

    c97dddaa1d48cd01cf7d7172cce619db86bc037f

  • SHA256

    865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a

  • SHA512

    d3139a243ea3d067b0ae64c432ed08911fa0fb14e174ab5a499556a428b03496d90b1ef64f2a72ec6ab74f31c3544755cb041db8de99daa69a6ad97ea2cf949e

  • SSDEEP

    12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2

Malware Config

Targets

    • Target

      865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a

    • Size

      784KB

    • MD5

      46a0e2b153610307b9e60b7a799e452e

    • SHA1

      c97dddaa1d48cd01cf7d7172cce619db86bc037f

    • SHA256

      865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a

    • SHA512

      d3139a243ea3d067b0ae64c432ed08911fa0fb14e174ab5a499556a428b03496d90b1ef64f2a72ec6ab74f31c3544755cb041db8de99daa69a6ad97ea2cf949e

    • SSDEEP

      12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks