Overview

overview

10

Static

static

3

AntiHacks.exe

windows7-x64

AntiHacks.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AntiHacks.exe

  • Size

    3.2MB

  • Sample

    240725-rns3zswdqe

  • MD5

    e0288245a40e10ff53abf8e72a92886b

  • SHA1

    e7c65a626687c6b3e2f72b9af6f3d4a037654fb9

  • SHA256

    e3f18a036f10a5bf7d92648a32f119bbdf79f3ad750532fcd2f70487a9783a19

  • SHA512

    56b7479c02371b318f3403a1715cf195a3f2fb7df66c718e9168943c79ec38d55252834138ef066f15eda3a62f9a7b2bceac855e5455d31380e11efc422f48ac

  • SSDEEP

    49152:6dsTqXFh3qCd825DyT8iHVmw6M2z0dcTaTfZb2fuYgZW83six0cJIjK3Uv+8sLFC:6d1dWAbkNcyZcuYgE4I258AXy

Score
10/10
dcratxwormdiscoveryevasionexecutioninfostealerrattrojan

Malware Config

Extracted

Family

xworm

C2

main-although.gl.at.ply.gg:30970

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Targets

    • Target

      AntiHacks.exe

    • Size

      3.2MB

    • MD5

      e0288245a40e10ff53abf8e72a92886b

    • SHA1

      e7c65a626687c6b3e2f72b9af6f3d4a037654fb9

    • SHA256

      e3f18a036f10a5bf7d92648a32f119bbdf79f3ad750532fcd2f70487a9783a19

    • SHA512

      56b7479c02371b318f3403a1715cf195a3f2fb7df66c718e9168943c79ec38d55252834138ef066f15eda3a62f9a7b2bceac855e5455d31380e11efc422f48ac

    • SSDEEP

      49152:6dsTqXFh3qCd825DyT8iHVmw6M2z0dcTaTfZb2fuYgZW83six0cJIjK3Uv+8sLFC:6d1dWAbkNcyZcuYgE4I258AXy

    Score
    10/10
    dcratxwormdiscoveryevasionexecutioninfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks