General

  • Target

    2a31d3dc6783dad77df215a986789fb27933fe4b5c59705eb20c256788d4533c.exe

  • Size

    1.1MB

  • Sample

    241230-cmzf2svjaw

  • MD5

    027bbb0a4d9b911c6d707866e98c1314

  • SHA1

    bfbdb849dcf89395492d916b69308505b87bb7fc

  • SHA256

    2a31d3dc6783dad77df215a986789fb27933fe4b5c59705eb20c256788d4533c

  • SHA512

    a66535cebff5e208c685c9f7a880e7bf36a70872cabd512ffdb8e97497c9f4438f7ebc213303487d9a652f1dabdbc438b5bd98be1cd0ed1accfe896cac69e94c

  • SSDEEP

    24576:U2G/nvxW3Ww0t9XYOIWhhyjpaMwvhIhL2pCrC:UbA309YOIXEElW

Malware Config

Targets

    • Target

      2a31d3dc6783dad77df215a986789fb27933fe4b5c59705eb20c256788d4533c.exe

    • Size

      1.1MB

    • MD5

      027bbb0a4d9b911c6d707866e98c1314

    • SHA1

      bfbdb849dcf89395492d916b69308505b87bb7fc

    • SHA256

      2a31d3dc6783dad77df215a986789fb27933fe4b5c59705eb20c256788d4533c

    • SHA512

      a66535cebff5e208c685c9f7a880e7bf36a70872cabd512ffdb8e97497c9f4438f7ebc213303487d9a652f1dabdbc438b5bd98be1cd0ed1accfe896cac69e94c

    • SSDEEP

      24576:U2G/nvxW3Ww0t9XYOIWhhyjpaMwvhIhL2pCrC:UbA309YOIXEElW

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks