General

  • Target

    34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73

  • Size

    1.3MB

  • Sample

    241221-v22ttsvkfr

  • MD5

    d02686d4b2a1c61c07b98db0504b5504

  • SHA1

    2d58d7061214cf8ff1cffe28bf78ce16756c334a

  • SHA256

    34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73

  • SHA512

    145c4079006b073a9591383fac1ea30ed89e8c33f6e71b792a543a8cc325a8e9c7ba504786b1c10dfbcdbe6d4fce323df6eb2029f7f4a5e49976dd3e33c30209

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73

    • Size

      1.3MB

    • MD5

      d02686d4b2a1c61c07b98db0504b5504

    • SHA1

      2d58d7061214cf8ff1cffe28bf78ce16756c334a

    • SHA256

      34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73

    • SHA512

      145c4079006b073a9591383fac1ea30ed89e8c33f6e71b792a543a8cc325a8e9c7ba504786b1c10dfbcdbe6d4fce323df6eb2029f7f4a5e49976dd3e33c30209

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks