General
-
Target
bee9c7a93024ffd0d7627056375f1f9c.exe
-
Size
2.0MB
-
Sample
230110-anb12abg4y
-
MD5
bee9c7a93024ffd0d7627056375f1f9c
-
SHA1
1eb29508f8d3de082b08f121314e340b14188baa
-
SHA256
c06d6991feb0affa394ee7017053b531fdb4abee8af7e1a81b9ec99f51f422eb
-
SHA512
0d032214ae45447f03b8c91b686b0764b695fa3ae3bc4d37dc62062ee2af00a58cbe19a61c1f91983bcca3562d27bd5dffeb7f1df78068bf2e3f29984fcf09c2
-
SSDEEP
49152:PmRzgfh/OPT0mREN4Z6gGPqHMLKgYypg57+zLrL0v:PizTRe4Z6t1OgYEg57kLA
Malware Config
Targets
-
-
Target
bee9c7a93024ffd0d7627056375f1f9c.exe
-
Size
2.0MB
-
MD5
bee9c7a93024ffd0d7627056375f1f9c
-
SHA1
1eb29508f8d3de082b08f121314e340b14188baa
-
SHA256
c06d6991feb0affa394ee7017053b531fdb4abee8af7e1a81b9ec99f51f422eb
-
SHA512
0d032214ae45447f03b8c91b686b0764b695fa3ae3bc4d37dc62062ee2af00a58cbe19a61c1f91983bcca3562d27bd5dffeb7f1df78068bf2e3f29984fcf09c2
-
SSDEEP
49152:PmRzgfh/OPT0mREN4Z6gGPqHMLKgYypg57+zLrL0v:PizTRe4Z6t1OgYEg57kLA
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-