General
-
Target
d1396a1ec855bd2cd988d0473161c5fba7ac170ba8e2f31b00d2689b517a0f22.exe
-
Size
1.0MB
-
Sample
240425-cf12asdc68
-
MD5
b321fbc4a5947b5e623708e11a166692
-
SHA1
a47346617fe2b1dda2920a23179daf9b36bbb06e
-
SHA256
d1396a1ec855bd2cd988d0473161c5fba7ac170ba8e2f31b00d2689b517a0f22
-
SHA512
6cbdbf2300c23d8026cc9a821c0d54f120589b9fee26efaca720250632a76e30cdfff9ce3b02063dc622f2b46d8e54383cbdcb9b9b13048307b78b78a8ab20ea
-
SSDEEP
24576:AOi7d/ahrZdwX405yXNI90r0JI3jX0OcsrBW:AOiW9qFc0O7
Behavioral task
behavioral1
Sample
d1396a1ec855bd2cd988d0473161c5fba7ac170ba8e2f31b00d2689b517a0f22.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d1396a1ec855bd2cd988d0473161c5fba7ac170ba8e2f31b00d2689b517a0f22.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
d1396a1ec855bd2cd988d0473161c5fba7ac170ba8e2f31b00d2689b517a0f22.exe
-
Size
1.0MB
-
MD5
b321fbc4a5947b5e623708e11a166692
-
SHA1
a47346617fe2b1dda2920a23179daf9b36bbb06e
-
SHA256
d1396a1ec855bd2cd988d0473161c5fba7ac170ba8e2f31b00d2689b517a0f22
-
SHA512
6cbdbf2300c23d8026cc9a821c0d54f120589b9fee26efaca720250632a76e30cdfff9ce3b02063dc622f2b46d8e54383cbdcb9b9b13048307b78b78a8ab20ea
-
SSDEEP
24576:AOi7d/ahrZdwX405yXNI90r0JI3jX0OcsrBW:AOiW9qFc0O7
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-