Overview

overview

10

Static

static

10

a13996ce9e...18.exe

windows7-x64

10

a13996ce9e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118

  • Size

    2.3MB

  • Sample

    241126-lref4swjbx

  • MD5

    a13996ce9ec70db775df5ee1c34792a4

  • SHA1

    878ddbd0fe9445f90b4a968eabb801d34eea16a6

  • SHA256

    addb6ddd0caa7af8df2241c7e80363a4efaf9a5b5fb58ee68f56ba9df251e54e

  • SHA512

    6f7b32a1406973bf32902155f27a347dd46fe3022452a73a53218deb82bce940f89e70ebf90e8dfa084054bacc0306c45cc9c36b1b4ea6b9d6d0142c24dc274f

  • SSDEEP

    49152:UbA30lmiYKzpT/IcR6Miss6OjdNXwVzZA/zY7o0VL:UbFYKzpT/76Miss6OwZ0zY7rVL

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118

    • Size

      2.3MB

    • MD5

      a13996ce9ec70db775df5ee1c34792a4

    • SHA1

      878ddbd0fe9445f90b4a968eabb801d34eea16a6

    • SHA256

      addb6ddd0caa7af8df2241c7e80363a4efaf9a5b5fb58ee68f56ba9df251e54e

    • SHA512

      6f7b32a1406973bf32902155f27a347dd46fe3022452a73a53218deb82bce940f89e70ebf90e8dfa084054bacc0306c45cc9c36b1b4ea6b9d6d0142c24dc274f

    • SSDEEP

      49152:UbA30lmiYKzpT/IcR6Miss6OjdNXwVzZA/zY7o0VL:UbFYKzpT/76Miss6OwZ0zY7rVL

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks