General

  • Target

    1ecdb1e51061eea9cb1d5cc68efb8921.exe

  • Size

    827KB

  • Sample

    240517-bc75rsac59

  • MD5

    1ecdb1e51061eea9cb1d5cc68efb8921

  • SHA1

    b0857042a2a73bcf08ef4004ba3cd03318d72278

  • SHA256

    f1f580e458f2c32aa1706a0e51cf3d0c0388bf5a5a90558e71aa27bddeb99995

  • SHA512

    d01a39114ad6853e94a64cbf00d05ba10edf002cc49c3d329583d35a851757419171d33d8c6a34845325491820f24597a07ca0ffddf69f9d3a9c438e091e6b6e

  • SSDEEP

    12288:Hi4hA51UtnsZtz2Deg5wrPs140sEBMBQ46gtsnh6LlfU8:Nhs1US2DeTrE14PQ46D+xU8

Score
10/10

Malware Config

Targets

    • Target

      1ecdb1e51061eea9cb1d5cc68efb8921.exe

    • Size

      827KB

    • MD5

      1ecdb1e51061eea9cb1d5cc68efb8921

    • SHA1

      b0857042a2a73bcf08ef4004ba3cd03318d72278

    • SHA256

      f1f580e458f2c32aa1706a0e51cf3d0c0388bf5a5a90558e71aa27bddeb99995

    • SHA512

      d01a39114ad6853e94a64cbf00d05ba10edf002cc49c3d329583d35a851757419171d33d8c6a34845325491820f24597a07ca0ffddf69f9d3a9c438e091e6b6e

    • SSDEEP

      12288:Hi4hA51UtnsZtz2Deg5wrPs140sEBMBQ46gtsnh6LlfU8:Nhs1US2DeTrE14PQ46D+xU8

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks