General
-
Target
96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe
-
Size
2.0MB
-
Sample
220803-j8z32aabcl
-
MD5
4f64c5ba875a44be67619fa8342bc777
-
SHA1
c192a53b53940892febe4bdba9adf9c940988d0f
-
SHA256
96ddb4fa1a296cccac8a22faa8773f1343e2ced466b478980d64f1af493c103a
-
SHA512
433086c6e4a26d8b7e58f67176ebb4ff9655fff67d07899911e3e5d49100a2e02d1d41907e0f1bdd2f627bc198a88fe907419755941d3cb31957ca155298daa1
Behavioral task
behavioral1
Sample
96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe
Resource
win10v2004-20220721-en
Malware Config
Targets
-
-
Target
96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe
-
Size
2.0MB
-
MD5
4f64c5ba875a44be67619fa8342bc777
-
SHA1
c192a53b53940892febe4bdba9adf9c940988d0f
-
SHA256
96ddb4fa1a296cccac8a22faa8773f1343e2ced466b478980d64f1af493c103a
-
SHA512
433086c6e4a26d8b7e58f67176ebb4ff9655fff67d07899911e3e5d49100a2e02d1d41907e0f1bdd2f627bc198a88fe907419755941d3cb31957ca155298daa1
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-