Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
36b4c1632f6121f74305e5af623f983c9b97b01080470c7daae076dff51b8c20.exe
-
Size
3.4MB
-
Sample
240510-blql3sab3t
-
MD5
1b57989c5c9ef0b64db6fbc2c88b346b
-
SHA1
75818e0eedd98f90c338edbc2ad6882f6a11fb06
-
SHA256
36b4c1632f6121f74305e5af623f983c9b97b01080470c7daae076dff51b8c20
-
SHA512
269cc8c6918a00a1df3e932ca3c7aec08913dfe2d545bc7bdcb9ced00b1038ada214ed167619b96a38a0c865889c0a590d3b8be1aaaa3c036db3ba0c9d65be7a
-
SSDEEP
49152:h7/RbqaJqrkG24yhaf1hD3uR4S1o+NO6QolF2YpwCgOGE2/xB/r/4ri:F1t5Qa4YowtJwCHG5xBj/4
Behavioral task
behavioral1
Sample
36b4c1632f6121f74305e5af623f983c9b97b01080470c7daae076dff51b8c20.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
36b4c1632f6121f74305e5af623f983c9b97b01080470c7daae076dff51b8c20.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
36b4c1632f6121f74305e5af623f983c9b97b01080470c7daae076dff51b8c20.exe
-
Size
3.4MB
-
MD5
1b57989c5c9ef0b64db6fbc2c88b346b
-
SHA1
75818e0eedd98f90c338edbc2ad6882f6a11fb06
-
SHA256
36b4c1632f6121f74305e5af623f983c9b97b01080470c7daae076dff51b8c20
-
SHA512
269cc8c6918a00a1df3e932ca3c7aec08913dfe2d545bc7bdcb9ced00b1038ada214ed167619b96a38a0c865889c0a590d3b8be1aaaa3c036db3ba0c9d65be7a
-
SSDEEP
49152:h7/RbqaJqrkG24yhaf1hD3uR4S1o+NO6QolF2YpwCgOGE2/xB/r/4ri:F1t5Qa4YowtJwCHG5xBj/4
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Detects executables packed with SmartAssembly
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1