General

  • Target

    JaffaCakes118_b549e4d3b566372561ed01c2d491e36e2d06d9fe7e5bcb5e7de1455f1d655c38

  • Size

    1.3MB

  • Sample

    241230-xh2e3awmhz

  • MD5

    8131ad0751651e8b589c792e7ab051e8

  • SHA1

    52ee387141b497b3f6719038bc15966de82f7641

  • SHA256

    b549e4d3b566372561ed01c2d491e36e2d06d9fe7e5bcb5e7de1455f1d655c38

  • SHA512

    454c1a1aa29931e9e22d7267e5f4188d9f638957fe14f79d2f1e360511cc1c954d23975d701e6c26409df70f361b697fb4104a10705ef810e9d707502d81f2f1

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      JaffaCakes118_b549e4d3b566372561ed01c2d491e36e2d06d9fe7e5bcb5e7de1455f1d655c38

    • Size

      1.3MB

    • MD5

      8131ad0751651e8b589c792e7ab051e8

    • SHA1

      52ee387141b497b3f6719038bc15966de82f7641

    • SHA256

      b549e4d3b566372561ed01c2d491e36e2d06d9fe7e5bcb5e7de1455f1d655c38

    • SHA512

      454c1a1aa29931e9e22d7267e5f4188d9f638957fe14f79d2f1e360511cc1c954d23975d701e6c26409df70f361b697fb4104a10705ef810e9d707502d81f2f1

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks