General

  • Target

    1d875bcd71102677c04e5db72094f6f9.exe

  • Size

    1.2MB

  • Sample

    240623-we5smssapk

  • MD5

    1d875bcd71102677c04e5db72094f6f9

  • SHA1

    0d4a9cb8d53328a6714431470674d95d044a0267

  • SHA256

    1a9615dd0d975c3f8310789455af28e3fb0938c20b7d8a9d85cafc7d8cafa02c

  • SHA512

    c4ba1f5fbdf619c40718a95bc5146d5b595f394bc8813582c3613b82fa5c020ec5d0c24974c121b27ade1ff5c342be68adac4d3800782865f19adb826c9bb497

  • SSDEEP

    24576:ofq5IC+ahvH7BxgM6/GpfDl+siRFlU+iHkZcI:oaRjlZcPU+iH

Score
10/10

Malware Config

Targets

    • Target

      1d875bcd71102677c04e5db72094f6f9.exe

    • Size

      1.2MB

    • MD5

      1d875bcd71102677c04e5db72094f6f9

    • SHA1

      0d4a9cb8d53328a6714431470674d95d044a0267

    • SHA256

      1a9615dd0d975c3f8310789455af28e3fb0938c20b7d8a9d85cafc7d8cafa02c

    • SHA512

      c4ba1f5fbdf619c40718a95bc5146d5b595f394bc8813582c3613b82fa5c020ec5d0c24974c121b27ade1ff5c342be68adac4d3800782865f19adb826c9bb497

    • SSDEEP

      24576:ofq5IC+ahvH7BxgM6/GpfDl+siRFlU+iHkZcI:oaRjlZcPU+iH

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks