Overview

overview

10

Static

static

3

JaffaCakes...cb.exe

windows7-x64

10

JaffaCakes...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_e15640ee50e585dc2d22e8034af222cb

  • Size

    2.3MB

  • Sample

    250110-lxqrbstkhr

  • MD5

    e15640ee50e585dc2d22e8034af222cb

  • SHA1

    ae603bf050d70b779414bf2860ed6874fadecdeb

  • SHA256

    046bf975b725c82f7bb4b76cca785b0fb740b9d006c660cd96bc6ce7b70287d1

  • SHA512

    cac1d6eee85eebce728be7038cfffb2fc020013b425bd1413924ebe712b51ab02faa6be2d077a35b106a563bf9b1aecbd53b60604d2c6bb614b089399cb4ce38

  • SSDEEP

    12288:5qnODPqBVA4VzeVeMvmw2b2iaNn0f7IF45i5ZwMr+FngnRtyS37WfGSindZTJiC6:5+O4GJvx75OgnRUSLHdFNz5kfe5f

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_e15640ee50e585dc2d22e8034af222cb

    • Size

      2.3MB

    • MD5

      e15640ee50e585dc2d22e8034af222cb

    • SHA1

      ae603bf050d70b779414bf2860ed6874fadecdeb

    • SHA256

      046bf975b725c82f7bb4b76cca785b0fb740b9d006c660cd96bc6ce7b70287d1

    • SHA512

      cac1d6eee85eebce728be7038cfffb2fc020013b425bd1413924ebe712b51ab02faa6be2d077a35b106a563bf9b1aecbd53b60604d2c6bb614b089399cb4ce38

    • SSDEEP

      12288:5qnODPqBVA4VzeVeMvmw2b2iaNn0f7IF45i5ZwMr+FngnRtyS37WfGSindZTJiC6:5+O4GJvx75OgnRUSLHdFNz5kfe5f

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks