General
- Target 2fb35c4ae7f69057974364351375bfb9.exe
- Size 750KB
- Sample260927-eelw4ayble
- SHA256 fab9726534078808667e3e330bf24152919f74893067ec8cc40f21b0d025fbb8
Score
10/10
Malware Config
Targets
-
- Target 2fb35c4ae7f69057974364351375bfb9.exe
- Size 750KB
- SHA256 fab9726534078808667e3e330bf24152919f74893067ec8cc40f21b0d025fbb8
Score10/10-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Executes dropped EXE
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Masquerading
1Match Legitimate Name or Location
1Modify Registry
1