General
-
Target
HEUR-Backdoor.MSIL.LightStone.gen-ea8525ed14b.exe
-
Size
1.4MB
-
Sample
230604-dlqyysbd7x
-
MD5
86855a4c90ef303681ee3d2139033042
-
SHA1
8492cdedf5f5a61c08582607c1bbede20c325020
-
SHA256
ea8525ed14bdc8f98f18f97b86b2853749eb99f1a517b7dfed4257dae18a7ce9
-
SHA512
a091565a282bb7bba6a3c23fbb198d9eb59cde9a9d8c2877eb25b690468c0696bc9ef45fd47e2c0930e2aee10b953b308305ea8f0e2729c385127c581be95d79
-
SSDEEP
24576:q2G/nvxW3WuU7l19j0EF+b9ZEFMwHjM7pyscuEHvbp/lgN+4:qbA3Q2BZEHw7pWIU
Behavioral task
behavioral1
Sample
HEUR-Backdoor.MSIL.LightStone.gen-ea8525ed14b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
HEUR-Backdoor.MSIL.LightStone.gen-ea8525ed14b.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
HEUR-Backdoor.MSIL.LightStone.gen-ea8525ed14b.exe
-
Size
1.4MB
-
MD5
86855a4c90ef303681ee3d2139033042
-
SHA1
8492cdedf5f5a61c08582607c1bbede20c325020
-
SHA256
ea8525ed14bdc8f98f18f97b86b2853749eb99f1a517b7dfed4257dae18a7ce9
-
SHA512
a091565a282bb7bba6a3c23fbb198d9eb59cde9a9d8c2877eb25b690468c0696bc9ef45fd47e2c0930e2aee10b953b308305ea8f0e2729c385127c581be95d79
-
SSDEEP
24576:q2G/nvxW3WuU7l19j0EF+b9ZEFMwHjM7pyscuEHvbp/lgN+4:qbA3Q2BZEHw7pWIU
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-