General

  • Target

    JaffaCakes118_9f8b8ac867cd1a010cb7ee732ad73eef9d7b5f7d75238801ffb4f926ec84d625

  • Size

    1.3MB

  • Sample

    241230-dc9dyawjhy

  • MD5

    2ed6c069b6817d5188e602d9f79b6485

  • SHA1

    221046738344c002d758ee1cf2d7adc9f10475f1

  • SHA256

    9f8b8ac867cd1a010cb7ee732ad73eef9d7b5f7d75238801ffb4f926ec84d625

  • SHA512

    826f5c8552d2cb8f7b6ae2b234e518b82b4d8b8ce69b5d2e6bbcd3b489dbaf948cf838d72ed1475aaa08aafb079d2b3794438191337c4ac27567ce3317c67b25

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      JaffaCakes118_9f8b8ac867cd1a010cb7ee732ad73eef9d7b5f7d75238801ffb4f926ec84d625

    • Size

      1.3MB

    • MD5

      2ed6c069b6817d5188e602d9f79b6485

    • SHA1

      221046738344c002d758ee1cf2d7adc9f10475f1

    • SHA256

      9f8b8ac867cd1a010cb7ee732ad73eef9d7b5f7d75238801ffb4f926ec84d625

    • SHA512

      826f5c8552d2cb8f7b6ae2b234e518b82b4d8b8ce69b5d2e6bbcd3b489dbaf948cf838d72ed1475aaa08aafb079d2b3794438191337c4ac27567ce3317c67b25

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks