General

  • Target

    439bcad86efe793e25a896bedbebbcbb1de01905eece9fa49cb5856a1bd562d4.exe

  • Size

    829KB

  • Sample

    240514-qx588shf64

  • MD5

    3bd8d1abdfdf35856a1b35c6824bd6f2

  • SHA1

    3e6e83f044690b2e5ffec74ebdef0ec9d4e8a02b

  • SHA256

    439bcad86efe793e25a896bedbebbcbb1de01905eece9fa49cb5856a1bd562d4

  • SHA512

    11387da3bb436ce4968eeaa03d0880b2eaa5cba780a8e393c060b0828e187d9527c24dd545f8fe3f8ad02a834cc0831d78d70e823047bf758ba42da01e0fc797

  • SSDEEP

    12288:Qu1cCMKdiaT3Ok1MVBFdpkj6fe9BSbwfKyw8:VOlKUaT3O7VBFdpLWQEfKyP

Score
10/10

Malware Config

Targets

    • Target

      439bcad86efe793e25a896bedbebbcbb1de01905eece9fa49cb5856a1bd562d4.exe

    • Size

      829KB

    • MD5

      3bd8d1abdfdf35856a1b35c6824bd6f2

    • SHA1

      3e6e83f044690b2e5ffec74ebdef0ec9d4e8a02b

    • SHA256

      439bcad86efe793e25a896bedbebbcbb1de01905eece9fa49cb5856a1bd562d4

    • SHA512

      11387da3bb436ce4968eeaa03d0880b2eaa5cba780a8e393c060b0828e187d9527c24dd545f8fe3f8ad02a834cc0831d78d70e823047bf758ba42da01e0fc797

    • SSDEEP

      12288:Qu1cCMKdiaT3Ok1MVBFdpkj6fe9BSbwfKyw8:VOlKUaT3O7VBFdpLWQEfKyP

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks