General
- Target 35FA07119FCEC6389BAC83D4FB7F4CD8.exe
- Size 2.2MB
- Sample261014-ce8dzsty9r
- SHA256 c36ab8841d94861719e99c97d55a92c36d2a27c67e0d66a815dd31a50d2c538e
Score
10/10
Malware Config
Targets
-
- Target 35FA07119FCEC6389BAC83D4FB7F4CD8.exe
- Size 2.2MB
- SHA256 c36ab8841d94861719e99c97d55a92c36d2a27c67e0d66a815dd31a50d2c538e
Score10/10-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1