General
-
Target
Locker.exe
-
Size
1.6MB
-
Sample
240713-skk4mswblp
-
MD5
1849f89a807de47190139035f6148366
-
SHA1
0e23f3cfc246483f5dd17815fea3d5011f6611c7
-
SHA256
131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac
-
SHA512
49398d7a4f763caf39385945abbc3c028be655fa4d89f05b638708f2e1d790c94deee45e3fd14c7c34acba71c037f6d155514c69342a2257f1a21c084488d154
-
SSDEEP
24576:05YLUm55/+Bo4L+n5iSFjw0bAtnG/E4yUzJu/iPenTjabqlfii9m2JKSTMGsWq1x:05o52O4LCBinG/hXuGkSGKgy
Static task
static1
Behavioral task
behavioral1
Sample
Locker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Locker.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
Locker.exe
-
Size
1.6MB
-
MD5
1849f89a807de47190139035f6148366
-
SHA1
0e23f3cfc246483f5dd17815fea3d5011f6611c7
-
SHA256
131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac
-
SHA512
49398d7a4f763caf39385945abbc3c028be655fa4d89f05b638708f2e1d790c94deee45e3fd14c7c34acba71c037f6d155514c69342a2257f1a21c084488d154
-
SSDEEP
24576:05YLUm55/+Bo4L+n5iSFjw0bAtnG/E4yUzJu/iPenTjabqlfii9m2JKSTMGsWq1x:05o52O4LCBinG/hXuGkSGKgy
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-