General
-
Target
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229
-
Size
1.2MB
-
Sample
240424-sfefasca77
-
MD5
1e1141a8c3483801e0520a803d004dfc
-
SHA1
4dd65bf996f2ab466e658208cc6d36b9bd63df7f
-
SHA256
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229
-
SHA512
cc1aa00306b66af19f3fe2e32c730d928da6e5f80b78c7131ef5936d9984d5a60190ec4a061446b77d797a44a7b9a5f034e64b1c39fb5bd52c8060ec1a24c562
-
SSDEEP
24576:FR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:rJaDKf4p4UD1v
Behavioral task
behavioral1
Sample
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229
-
Size
1.2MB
-
MD5
1e1141a8c3483801e0520a803d004dfc
-
SHA1
4dd65bf996f2ab466e658208cc6d36b9bd63df7f
-
SHA256
3915927862667dcfed03c9f5cd6b9af7ff6840bcc4226b06404320f9e2212229
-
SHA512
cc1aa00306b66af19f3fe2e32c730d928da6e5f80b78c7131ef5936d9984d5a60190ec4a061446b77d797a44a7b9a5f034e64b1c39fb5bd52c8060ec1a24c562
-
SSDEEP
24576:FR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:rJaDKf4p4UD1v
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Detects executables containing bas64 encoded gzip files
-
Detects executables packed with SmartAssembly
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1