General

  • Target

    JaffaCakes118_f209430a5ca3dbff5c1b735e7c744adfcde09919b319b79899785125a5a3f139

  • Size

    1.3MB

  • Sample

    241230-dkz58swmen

  • MD5

    b40eb247eaebfc6b936f510d8f286e8e

  • SHA1

    bad0fa590945b92979631b7ca0e880305e35816e

  • SHA256

    f209430a5ca3dbff5c1b735e7c744adfcde09919b319b79899785125a5a3f139

  • SHA512

    1f1c2dbe65ad7e8bf29d2af442361d6f12b16e6ce8a62d62392ea017ad3bdee370083c0f09c158bbd52d5b6cdbbca48e98e1b45ae804a7883866adebc991e7eb

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      JaffaCakes118_f209430a5ca3dbff5c1b735e7c744adfcde09919b319b79899785125a5a3f139

    • Size

      1.3MB

    • MD5

      b40eb247eaebfc6b936f510d8f286e8e

    • SHA1

      bad0fa590945b92979631b7ca0e880305e35816e

    • SHA256

      f209430a5ca3dbff5c1b735e7c744adfcde09919b319b79899785125a5a3f139

    • SHA512

      1f1c2dbe65ad7e8bf29d2af442361d6f12b16e6ce8a62d62392ea017ad3bdee370083c0f09c158bbd52d5b6cdbbca48e98e1b45ae804a7883866adebc991e7eb

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks