Overview

overview

10

Static

static

10

JaffaCakes...34.exe

windows7-x64

10

JaffaCakes...34.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_49553a3723093f4361cdf77547592034

  • Size

    924KB

  • Sample

    250107-dcbsns1jbs

  • MD5

    49553a3723093f4361cdf77547592034

  • SHA1

    ebeec0f51b8e6b1411b39cf5593d24d1f27d793b

  • SHA256

    e02a9abbe5c79163179eeb4d55dcfa5efb3b086fad361dac925fe013a71c7577

  • SHA512

    27ee188f12f8f90e26c82300d23a5356e92fd73b924096a4ed031a6e9a0e2cde6f53c16e0cbe4b55e91fb60d2339bc09e3c7f094f5d0bb8385122f38e5331658

  • SSDEEP

    12288:aRZ+IoG/n9IQxW3OBsee2X+t4RboqnOH0qhDD2hBM5biqZUAu09SwRRpfcA:U2G/nvxW3Ww0to+OHt7iefRpfF

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_49553a3723093f4361cdf77547592034

    • Size

      924KB

    • MD5

      49553a3723093f4361cdf77547592034

    • SHA1

      ebeec0f51b8e6b1411b39cf5593d24d1f27d793b

    • SHA256

      e02a9abbe5c79163179eeb4d55dcfa5efb3b086fad361dac925fe013a71c7577

    • SHA512

      27ee188f12f8f90e26c82300d23a5356e92fd73b924096a4ed031a6e9a0e2cde6f53c16e0cbe4b55e91fb60d2339bc09e3c7f094f5d0bb8385122f38e5331658

    • SSDEEP

      12288:aRZ+IoG/n9IQxW3OBsee2X+t4RboqnOH0qhDD2hBM5biqZUAu09SwRRpfcA:U2G/nvxW3Ww0to+OHt7iefRpfF

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks