General
-
Target
942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe
-
Size
8.4MB
-
Sample
240517-b55v4sbe6y
-
MD5
5d474e6a5232b3d3dd5576111a2b22a1
-
SHA1
60923eeaaf6334dde034a338302bcc25a2552618
-
SHA256
942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc
-
SHA512
93794f9a4548c55ab64bdf0a72a5aa08271e7ca58793de0c20c34dbff679638c22a6515e8c402ed8cf41c0a8db25f2aea33a2552fb633f43fc1bcfd7d22fdfae
-
SSDEEP
98304:tVDbpZYm4jCCC08mudOK+rdYsL9mJ+C01l96Y:tVDbpZYxBC0wWrdYB+tl9B
Static task
static1
Behavioral task
behavioral1
Sample
942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe
-
Size
8.4MB
-
MD5
5d474e6a5232b3d3dd5576111a2b22a1
-
SHA1
60923eeaaf6334dde034a338302bcc25a2552618
-
SHA256
942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc
-
SHA512
93794f9a4548c55ab64bdf0a72a5aa08271e7ca58793de0c20c34dbff679638c22a6515e8c402ed8cf41c0a8db25f2aea33a2552fb633f43fc1bcfd7d22fdfae
-
SSDEEP
98304:tVDbpZYm4jCCC08mudOK+rdYsL9mJ+C01l96Y:tVDbpZYxBC0wWrdYB+tl9B
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Detects executables packed with SmartAssembly
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1