General
-
Target
84b838dc7b84476ab2d5eb8989a6e3921d01d96810292a646563bd0e1dd9a972
-
Size
1.2MB
-
Sample
240423-aqfr1aab26
-
MD5
bba932293b24ba09742bf12beac581f0
-
SHA1
8a9eebde6ad570b3f935742d5d9f65bf31078e3c
-
SHA256
84b838dc7b84476ab2d5eb8989a6e3921d01d96810292a646563bd0e1dd9a972
-
SHA512
f1fd972eec339bb1c443bb9f13ab8e9c09e810276656d3a9ecf649b70ba9374ac088d6db8e40a40010724dde05db5950dfcc1e7b7b7059faefcdd2c4a0521c34
-
SSDEEP
24576:tR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:zJaDKf4p4UD1v
Behavioral task
behavioral1
Sample
84b838dc7b84476ab2d5eb8989a6e3921d01d96810292a646563bd0e1dd9a972.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
84b838dc7b84476ab2d5eb8989a6e3921d01d96810292a646563bd0e1dd9a972.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
84b838dc7b84476ab2d5eb8989a6e3921d01d96810292a646563bd0e1dd9a972
-
Size
1.2MB
-
MD5
bba932293b24ba09742bf12beac581f0
-
SHA1
8a9eebde6ad570b3f935742d5d9f65bf31078e3c
-
SHA256
84b838dc7b84476ab2d5eb8989a6e3921d01d96810292a646563bd0e1dd9a972
-
SHA512
f1fd972eec339bb1c443bb9f13ab8e9c09e810276656d3a9ecf649b70ba9374ac088d6db8e40a40010724dde05db5950dfcc1e7b7b7059faefcdd2c4a0521c34
-
SSDEEP
24576:tR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:zJaDKf4p4UD1v
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Detects executables containing bas64 encoded gzip files
-
Detects executables packed with SmartAssembly
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1