General

  • Target

    1f9c3cddc1c0c5f3411caa896e02350a.exe

  • Size

    1.1MB

  • Sample

    240530-mdm2rsfa65

  • MD5

    1f9c3cddc1c0c5f3411caa896e02350a

  • SHA1

    5c7e7074e9ee1b446890deb4eda500d5be074092

  • SHA256

    3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75

  • SHA512

    8cd0bd635431b23d7f29fa274d0d2bef1da0c94cbf5b927c34d12a67d1a19b7ead6b46257e1bb8d1880e72965ee7b068c1d059bb317fcaa3917c71993efb9bb9

  • SSDEEP

    24576:U2G/nvxW3Ww0trmGK9uhJ4bNJYrvyunNnLskPF:UbA30CGK9ve9n

Score
10/10

Malware Config

Targets

    • Target

      1f9c3cddc1c0c5f3411caa896e02350a.exe

    • Size

      1.1MB

    • MD5

      1f9c3cddc1c0c5f3411caa896e02350a

    • SHA1

      5c7e7074e9ee1b446890deb4eda500d5be074092

    • SHA256

      3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75

    • SHA512

      8cd0bd635431b23d7f29fa274d0d2bef1da0c94cbf5b927c34d12a67d1a19b7ead6b46257e1bb8d1880e72965ee7b068c1d059bb317fcaa3917c71993efb9bb9

    • SSDEEP

      24576:U2G/nvxW3Ww0trmGK9uhJ4bNJYrvyunNnLskPF:UbA30CGK9ve9n

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks