Overview

overview

10

Static

static

10

JaffaCakes...47.exe

windows7-x64

10

JaffaCakes...47.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147

  • Size

    2.0MB

  • Sample

    250110-jcnp5axjex

  • MD5

    de80b75daf9e3549c0d61166fbe0f147

  • SHA1

    445c7a4e543c319dff09d12b77b9aa33bfccc5ff

  • SHA256

    7a89d7167264d77656b8cac1cef82a3e16f3dd51d679b178833a953a5cb11235

  • SHA512

    83f8b92ef215e0398ee38963bcedce1590384b0f1a8f17cb09749c887c78ede374890965a01cb475ac0794a4eafb5ac7c0b48e347a6df7eda58b2fe1cbe657d1

  • SSDEEP

    49152:cwj3o71JZAB3jBn8cjcdPH/+yDMu3JgHzCueUTG:cBLZABTF8Ic94u3YveX

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147

    • Size

      2.0MB

    • MD5

      de80b75daf9e3549c0d61166fbe0f147

    • SHA1

      445c7a4e543c319dff09d12b77b9aa33bfccc5ff

    • SHA256

      7a89d7167264d77656b8cac1cef82a3e16f3dd51d679b178833a953a5cb11235

    • SHA512

      83f8b92ef215e0398ee38963bcedce1590384b0f1a8f17cb09749c887c78ede374890965a01cb475ac0794a4eafb5ac7c0b48e347a6df7eda58b2fe1cbe657d1

    • SSDEEP

      49152:cwj3o71JZAB3jBn8cjcdPH/+yDMu3JgHzCueUTG:cBLZABTF8Ic94u3YveX

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks