General
-
Target
Nursultan.exe
-
Size
1.4MB
-
Sample
240703-w8fqlsscrr
-
MD5
1b6293c7f0dfed044b0eba8b98b0faff
-
SHA1
e5705cbb256bb0b1a350e1b9fb71c1a1e4ac605a
-
SHA256
fe014092ae92e8372849bed9f5cf33946e8d918bdc50feddc1316bc837414ba8
-
SHA512
694e9afd04089172c991a712849049545459ceeed99780a6f012ca086fa2d1b70bbd627534b85b1797f4be22feda55e46e6966fe96a2ee66effdeeaa2eb650a5
-
SSDEEP
24576:d2G/nvxW3WckpJWjXbNQsVZy8v8BQSsZWcJ48z2AB4:dbA3wvW+sVZy8fZWmz9
Behavioral task
behavioral1
Sample
Nursultan.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Nursultan.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1253689379948593173/lzPh5dDD7ETWYLRPMt2M_Ml82yS42YxolYTwBWldi4NXuLOvpMPhz7AlFtFln1RxcqaC
Targets
-
-
Target
Nursultan.exe
-
Size
1.4MB
-
MD5
1b6293c7f0dfed044b0eba8b98b0faff
-
SHA1
e5705cbb256bb0b1a350e1b9fb71c1a1e4ac605a
-
SHA256
fe014092ae92e8372849bed9f5cf33946e8d918bdc50feddc1316bc837414ba8
-
SHA512
694e9afd04089172c991a712849049545459ceeed99780a6f012ca086fa2d1b70bbd627534b85b1797f4be22feda55e46e6966fe96a2ee66effdeeaa2eb650a5
-
SSDEEP
24576:d2G/nvxW3WckpJWjXbNQsVZy8v8BQSsZWcJ48z2AB4:dbA3wvW+sVZy8fZWmz9
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-