General
-
Target
sigmasoft3.exe
-
Size
12.8MB
-
Sample
241111-vvc7wsvrdk
-
MD5
aa456e4c575655fe9bb3c77802001a79
-
SHA1
56fcf170358da522c856fad9c9baea64ea90d04c
-
SHA256
eff428d886d5836082ce5d6ea48af9a2fd411188a8be54f7f67ff3d9ba557a44
-
SHA512
1f05f12ba147258c388791689b678fab42a09cef555493753f06cbc1e388ebeebab902599bf644d01bf52d0d9a85a33ad70bc39669df2ceb32f9740219fe0c38
-
SSDEEP
196608:ZqwbT2PrGWsSWCSHhINEDIGMVIiSmY1EYKq59YNh0tMGEy/WAKfK6EaK6pMo:lSPVPSHFDIDOb5NtMjy/yfK66c
Static task
static1
Behavioral task
behavioral1
Sample
sigmasoft3.exe
Resource
win10ltsc2021-20241023-en
Malware Config
Targets
-
-
Target
sigmasoft3.exe
-
Size
12.8MB
-
MD5
aa456e4c575655fe9bb3c77802001a79
-
SHA1
56fcf170358da522c856fad9c9baea64ea90d04c
-
SHA256
eff428d886d5836082ce5d6ea48af9a2fd411188a8be54f7f67ff3d9ba557a44
-
SHA512
1f05f12ba147258c388791689b678fab42a09cef555493753f06cbc1e388ebeebab902599bf644d01bf52d0d9a85a33ad70bc39669df2ceb32f9740219fe0c38
-
SSDEEP
196608:ZqwbT2PrGWsSWCSHhINEDIGMVIiSmY1EYKq59YNh0tMGEy/WAKfK6EaK6pMo:lSPVPSHFDIDOb5NtMjy/yfK66c
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Xmrig family
-
XMRig Miner payload
-
Creates new service(s)
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
3Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1