General
-
Target
1f9c3cddc1c0c5f3411caa896e02350a.exe
-
Size
1.1MB
-
Sample
240530-mdm2rsfa65
-
MD5
1f9c3cddc1c0c5f3411caa896e02350a
-
SHA1
5c7e7074e9ee1b446890deb4eda500d5be074092
-
SHA256
3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75
-
SHA512
8cd0bd635431b23d7f29fa274d0d2bef1da0c94cbf5b927c34d12a67d1a19b7ead6b46257e1bb8d1880e72965ee7b068c1d059bb317fcaa3917c71993efb9bb9
-
SSDEEP
24576:U2G/nvxW3Ww0trmGK9uhJ4bNJYrvyunNnLskPF:UbA30CGK9ve9n
Behavioral task
behavioral1
Sample
1f9c3cddc1c0c5f3411caa896e02350a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1f9c3cddc1c0c5f3411caa896e02350a.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
1f9c3cddc1c0c5f3411caa896e02350a.exe
-
Size
1.1MB
-
MD5
1f9c3cddc1c0c5f3411caa896e02350a
-
SHA1
5c7e7074e9ee1b446890deb4eda500d5be074092
-
SHA256
3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75
-
SHA512
8cd0bd635431b23d7f29fa274d0d2bef1da0c94cbf5b927c34d12a67d1a19b7ead6b46257e1bb8d1880e72965ee7b068c1d059bb317fcaa3917c71993efb9bb9
-
SSDEEP
24576:U2G/nvxW3Ww0trmGK9uhJ4bNJYrvyunNnLskPF:UbA30CGK9ve9n
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-