General

  • Target

    1b621eb6ee7bcda09947de50eaf562020f5edb858d82f8d852dc67265f7e74c1.exe

  • Size

    829KB

  • Sample

    241003-bjb1xawgjn

  • MD5

    207fd3471dc4f4fe474cf9f288e3b1c1

  • SHA1

    40a907ec64d541305b5f8462f19a4c710528dcc1

  • SHA256

    1b621eb6ee7bcda09947de50eaf562020f5edb858d82f8d852dc67265f7e74c1

  • SHA512

    373e94ccddb88180fb3559f5a09a17f8bbdaffc6e4a3afdda34cd3b48dde43efb0e5b7268f437cffc00e1650cc7bc24a85edf0e7505acc67167f834d058059b6

  • SSDEEP

    12288:phGvLmYJoTbOPeb2W2oM0aKpmINkiA+ZeewPeWNBMJshWso:ySCsOPeRpmI6ihBWNBMiG

Score
10/10

Malware Config

Targets

    • Target

      1b621eb6ee7bcda09947de50eaf562020f5edb858d82f8d852dc67265f7e74c1.exe

    • Size

      829KB

    • MD5

      207fd3471dc4f4fe474cf9f288e3b1c1

    • SHA1

      40a907ec64d541305b5f8462f19a4c710528dcc1

    • SHA256

      1b621eb6ee7bcda09947de50eaf562020f5edb858d82f8d852dc67265f7e74c1

    • SHA512

      373e94ccddb88180fb3559f5a09a17f8bbdaffc6e4a3afdda34cd3b48dde43efb0e5b7268f437cffc00e1650cc7bc24a85edf0e7505acc67167f834d058059b6

    • SSDEEP

      12288:phGvLmYJoTbOPeb2W2oM0aKpmINkiA+ZeewPeWNBMJshWso:ySCsOPeRpmI6ihBWNBMiG

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks