General
- Target 15c730b69a961a70a764d6c103c8103d.bin
- Size 2.2MB
- Sample240604-blppsaga3z
- SHA256 1708bc9c8a32a51d02bd61d04ee209d7da29d6b9c9b0a417e504b97690454bb1
Score
10/10
Malware Config
Targets
-
- Target 09bbdf5b842a244123b81ba715cd80776f83fcff31994a07376112e3524135c5.exe
- Size 2.8MB
- SHA256 09bbdf5b842a244123b81ba715cd80776f83fcff31994a07376112e3524135c5
Score10/10DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
UAC bypass
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
Blocklisted process makes network request
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1