General
-
Target
13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe
-
Size
1.6MB
-
Sample
240523-bhgj1afh4y
-
MD5
a0fc62e3b7ee3716781698677ef0a315
-
SHA1
679ee9e6c503af58943768fac7801a0c85149728
-
SHA256
13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc
-
SHA512
6d5f5cde273aebea5e97561c94e3a068e3b966dc0d8455d90f0bedcefbe2cd888457c60f639e77cdd3e6bd2b79b45fe1467f6eded81ddaf92ff6fde1bd2ba30b
-
SSDEEP
49152:BI3GKRB71HIfHaM+j4av2JIZF9YvOaXdFi:qPRB5HISGauJIn95eo
Static task
static1
Behavioral task
behavioral1
Sample
13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe
Resource
win7-20240508-en
Malware Config
Targets
-
-
Target
13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe
-
Size
1.6MB
-
MD5
a0fc62e3b7ee3716781698677ef0a315
-
SHA1
679ee9e6c503af58943768fac7801a0c85149728
-
SHA256
13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc
-
SHA512
6d5f5cde273aebea5e97561c94e3a068e3b966dc0d8455d90f0bedcefbe2cd888457c60f639e77cdd3e6bd2b79b45fe1467f6eded81ddaf92ff6fde1bd2ba30b
-
SSDEEP
49152:BI3GKRB71HIfHaM+j4av2JIZF9YvOaXdFi:qPRB5HISGauJIn95eo
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Detects executables packed with SmartAssembly
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1