Overview

overview

10

Static

static

3

CrackLauncher.exe

windows7-x64

10

CrackLauncher.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CrackLauncher.exe

  • Size

    2.8MB

  • Sample

    240725-xglcfs1eke

  • MD5

    f2ce023c5bc17140b9776f0c7c47913d

  • SHA1

    c35da6e6fec72b5bd8918d9a370a86347e6d3388

  • SHA256

    532c0ef8e8b0d52ca5cb608fbb92d0f3ac676573e70505380e3f3c5a447811fa

  • SHA512

    c6ec3df9578e79b0fa1c6637cc89ce4f19936192e4ce557f0af55c41bd879639acd837c5114b8c6162fe32417bb28d452bdc1c8f98dbff3e31e8d88541b4619b

  • SSDEEP

    49152:i5zytOoH9xol9B5e29dCIKrm21PLybe4Ny5KHfNbki93Mky:iPoHHch13CIMm21P4e4Ny5K1r93e

Score
10/10
dcratxwormdiscoveryevasionexecutioninfostealerrattrojan

Malware Config

Extracted

Family

xworm

C2

main-although.gl.at.ply.gg:30970

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Targets

    • Target

      CrackLauncher.exe

    • Size

      2.8MB

    • MD5

      f2ce023c5bc17140b9776f0c7c47913d

    • SHA1

      c35da6e6fec72b5bd8918d9a370a86347e6d3388

    • SHA256

      532c0ef8e8b0d52ca5cb608fbb92d0f3ac676573e70505380e3f3c5a447811fa

    • SHA512

      c6ec3df9578e79b0fa1c6637cc89ce4f19936192e4ce557f0af55c41bd879639acd837c5114b8c6162fe32417bb28d452bdc1c8f98dbff3e31e8d88541b4619b

    • SSDEEP

      49152:i5zytOoH9xol9B5e29dCIKrm21PLybe4Ny5KHfNbki93Mky:iPoHHch13CIMm21P4e4Ny5K1r93e

    Score
    10/10
    dcratxwormdiscoveryevasionexecutioninfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks