General
-
Target
8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN
-
Size
4.9MB
-
Sample
240917-ebecvashle
-
MD5
2c5faad0c4c5b9d351a4c51797e97240
-
SHA1
b34a6bd05c0f79d5a74817c1ed4fc2d3d9fa01d6
-
SHA256
8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78e
-
SHA512
0dc0495c73f494ffb2f12722960932340dfec112a5a9c1ba35c5f769c8773bc8a092545d9b1c1c07856ef9e716b76dea8ed7e6b4549fdf589d859ce5c3a4f19e
-
SSDEEP
49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Static task
static1
Behavioral task
behavioral1
Sample
8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe
Resource
win7-20240903-en
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Targets
-
-
Target
8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN
-
Size
4.9MB
-
MD5
2c5faad0c4c5b9d351a4c51797e97240
-
SHA1
b34a6bd05c0f79d5a74817c1ed4fc2d3d9fa01d6
-
SHA256
8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78e
-
SHA512
0dc0495c73f494ffb2f12722960932340dfec112a5a9c1ba35c5f769c8773bc8a092545d9b1c1c07856ef9e716b76dea8ed7e6b4549fdf589d859ce5c3a4f19e
-
SSDEEP
49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2