General

  • Target

    9f3f5dedf08c42914f6b49ee9fb5a615fe41d9add39a4187480fa04520db14be.exe

  • Size

    1.3MB

  • Sample

    241230-wr1z8avmbx

  • MD5

    6cf60d7301959af74e7a1e9eb824f2b8

  • SHA1

    0e034813129fb458e08f5f1b75be4a2ce1a5c48d

  • SHA256

    9f3f5dedf08c42914f6b49ee9fb5a615fe41d9add39a4187480fa04520db14be

  • SHA512

    68a5eefc5656a7ea49e92c89ecc09acc442c60b1d659bbfd47bd22d5391f3dad4c9bf974776daa7a879ffa5ab30722a9a2eeb9872fd09928b2e3f0e060ef9832

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCL:UbA30GnzV/q+DnsXgt

Malware Config

Targets

    • Target

      9f3f5dedf08c42914f6b49ee9fb5a615fe41d9add39a4187480fa04520db14be.exe

    • Size

      1.3MB

    • MD5

      6cf60d7301959af74e7a1e9eb824f2b8

    • SHA1

      0e034813129fb458e08f5f1b75be4a2ce1a5c48d

    • SHA256

      9f3f5dedf08c42914f6b49ee9fb5a615fe41d9add39a4187480fa04520db14be

    • SHA512

      68a5eefc5656a7ea49e92c89ecc09acc442c60b1d659bbfd47bd22d5391f3dad4c9bf974776daa7a879ffa5ab30722a9a2eeb9872fd09928b2e3f0e060ef9832

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCL:UbA30GnzV/q+DnsXgt

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks