General
- Target JustLauncherInstall.exe
- Size 27.2MB
- Sample261114-rv9pbaex2q
- SHA256 938622b2f5710f289f2f86f0f4f68f7711adeda58d0f116ff1ab8d48bafcfc11
Score
10/10
Malware Config
Targets
-
- Target JustLauncherInstall.exe
- Size 27.2MB
- SHA256 938622b2f5710f289f2f86f0f4f68f7711adeda58d0f116ff1ab8d48bafcfc11
Score10/10DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1