General
-
Target
1ecdb1e51061eea9cb1d5cc68efb8921.exe
-
Size
827KB
-
Sample
240517-bc75rsac59
-
MD5
1ecdb1e51061eea9cb1d5cc68efb8921
-
SHA1
b0857042a2a73bcf08ef4004ba3cd03318d72278
-
SHA256
f1f580e458f2c32aa1706a0e51cf3d0c0388bf5a5a90558e71aa27bddeb99995
-
SHA512
d01a39114ad6853e94a64cbf00d05ba10edf002cc49c3d329583d35a851757419171d33d8c6a34845325491820f24597a07ca0ffddf69f9d3a9c438e091e6b6e
-
SSDEEP
12288:Hi4hA51UtnsZtz2Deg5wrPs140sEBMBQ46gtsnh6LlfU8:Nhs1US2DeTrE14PQ46D+xU8
Behavioral task
behavioral1
Sample
1ecdb1e51061eea9cb1d5cc68efb8921.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1ecdb1e51061eea9cb1d5cc68efb8921.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
1ecdb1e51061eea9cb1d5cc68efb8921.exe
-
Size
827KB
-
MD5
1ecdb1e51061eea9cb1d5cc68efb8921
-
SHA1
b0857042a2a73bcf08ef4004ba3cd03318d72278
-
SHA256
f1f580e458f2c32aa1706a0e51cf3d0c0388bf5a5a90558e71aa27bddeb99995
-
SHA512
d01a39114ad6853e94a64cbf00d05ba10edf002cc49c3d329583d35a851757419171d33d8c6a34845325491820f24597a07ca0ffddf69f9d3a9c438e091e6b6e
-
SSDEEP
12288:Hi4hA51UtnsZtz2Deg5wrPs140sEBMBQ46gtsnh6LlfU8:Nhs1US2DeTrE14PQ46D+xU8
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-