General
-
Target
131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe
-
Size
1.6MB
-
Sample
240714-kmncsawdkf
-
MD5
1849f89a807de47190139035f6148366
-
SHA1
0e23f3cfc246483f5dd17815fea3d5011f6611c7
-
SHA256
131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac
-
SHA512
49398d7a4f763caf39385945abbc3c028be655fa4d89f05b638708f2e1d790c94deee45e3fd14c7c34acba71c037f6d155514c69342a2257f1a21c084488d154
-
SSDEEP
24576:05YLUm55/+Bo4L+n5iSFjw0bAtnG/E4yUzJu/iPenTjabqlfii9m2JKSTMGsWq1x:05o52O4LCBinG/hXuGkSGKgy
Static task
static1
Behavioral task
behavioral1
Sample
131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe
-
Size
1.6MB
-
MD5
1849f89a807de47190139035f6148366
-
SHA1
0e23f3cfc246483f5dd17815fea3d5011f6611c7
-
SHA256
131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac
-
SHA512
49398d7a4f763caf39385945abbc3c028be655fa4d89f05b638708f2e1d790c94deee45e3fd14c7c34acba71c037f6d155514c69342a2257f1a21c084488d154
-
SSDEEP
24576:05YLUm55/+Bo4L+n5iSFjw0bAtnG/E4yUzJu/iPenTjabqlfii9m2JKSTMGsWq1x:05o52O4LCBinG/hXuGkSGKgy
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Sets desktop wallpaper using registry
-