Overview

overview

10

Static

static

10

JaffaCakes...e1.exe

windows7-x64

10

JaffaCakes...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_dd5d99624481537c7a861118199327e1

  • Size

    2.4MB

  • Sample

    250110-hb9qjavqd1

  • MD5

    dd5d99624481537c7a861118199327e1

  • SHA1

    b05527ae0d68e4f49b6c3928b861c5b32651b8ef

  • SHA256

    a8b290c2a6e1f47e8d40dd37226ca96c05b442125dd920fe59c70ee4355e1f1a

  • SHA512

    f4ffa4e158820654cf4a1f5d53c575eb3e91954ac07389baa139e3a4cd8f3960a54af8f69f041b76bb301aa993e96159f4eafbfe57eba730476ceff14737eb7f

  • SSDEEP

    49152:UbA30qHwLrdtkbaCwcp4RXL7D764zB2qH+:UbtZiaYeL7DxB3+

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_dd5d99624481537c7a861118199327e1

    • Size

      2.4MB

    • MD5

      dd5d99624481537c7a861118199327e1

    • SHA1

      b05527ae0d68e4f49b6c3928b861c5b32651b8ef

    • SHA256

      a8b290c2a6e1f47e8d40dd37226ca96c05b442125dd920fe59c70ee4355e1f1a

    • SHA512

      f4ffa4e158820654cf4a1f5d53c575eb3e91954ac07389baa139e3a4cd8f3960a54af8f69f041b76bb301aa993e96159f4eafbfe57eba730476ceff14737eb7f

    • SSDEEP

      49152:UbA30qHwLrdtkbaCwcp4RXL7D764zB2qH+:UbtZiaYeL7DxB3+

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks