General

  • Target

    681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0N

  • Size

    826KB

  • Sample

    241004-cg3lhsycrp

  • MD5

    2bde3b50e8348b0c3588bb71849aa750

  • SHA1

    cfc337706db182ef87384b8b2cb5ff90e9aca101

  • SHA256

    681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0

  • SHA512

    dd8025439b4f8a85e6d3ddbee003b0cd7c8830ec56933a5c9ec4fcb3174767e6393186750f5507bba655327b7c39dc715f5716d1cf4d739aefb2ca948d4ef2d7

  • SSDEEP

    12288:V1OyAKpL5A9MM0Vm6PPkHG+V7PMmqbzhYjFUj8bKaH2FlQQk6:VoY4d0VPPkHG+VD3qQGAXW/QZ6

Score
10/10

Malware Config

Targets

    • Target

      681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0N

    • Size

      826KB

    • MD5

      2bde3b50e8348b0c3588bb71849aa750

    • SHA1

      cfc337706db182ef87384b8b2cb5ff90e9aca101

    • SHA256

      681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0

    • SHA512

      dd8025439b4f8a85e6d3ddbee003b0cd7c8830ec56933a5c9ec4fcb3174767e6393186750f5507bba655327b7c39dc715f5716d1cf4d739aefb2ca948d4ef2d7

    • SSDEEP

      12288:V1OyAKpL5A9MM0Vm6PPkHG+V7PMmqbzhYjFUj8bKaH2FlQQk6:VoY4d0VPPkHG+VD3qQGAXW/QZ6

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks