General
-
Target
84ffe1fe9ff878e3cf0a4f91a9a57964845dc96634fc11e95ee0ef8edb2ce719
-
Size
2.1MB
-
Sample
241030-bq9whsvmhk
-
MD5
24f297e399f1471c6dbdcc3963e5d66f
-
SHA1
5abc4979b83ca42241e55299e0ebf93c97a54c23
-
SHA256
84ffe1fe9ff878e3cf0a4f91a9a57964845dc96634fc11e95ee0ef8edb2ce719
-
SHA512
0c9adbaedde18b2213aab82bfabcad4af71a943751b434669c9df6b4c0fe13ca17e579ac6240bc2c966b8db26c85404af10fb1565953a101471062baf68af498
-
SSDEEP
24576:2TbBv5rUyXVlO8V8ikUJRQnpkPtG4HYy5hJoiJ4BUUCMmX8yvYs+UYFtaSlr3:IBJleiLOQNMbNqQs+UYF7
Static task
static1
Behavioral task
behavioral1
Sample
84ffe1fe9ff878e3cf0a4f91a9a57964845dc96634fc11e95ee0ef8edb2ce719.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
84ffe1fe9ff878e3cf0a4f91a9a57964845dc96634fc11e95ee0ef8edb2ce719.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
84ffe1fe9ff878e3cf0a4f91a9a57964845dc96634fc11e95ee0ef8edb2ce719
-
Size
2.1MB
-
MD5
24f297e399f1471c6dbdcc3963e5d66f
-
SHA1
5abc4979b83ca42241e55299e0ebf93c97a54c23
-
SHA256
84ffe1fe9ff878e3cf0a4f91a9a57964845dc96634fc11e95ee0ef8edb2ce719
-
SHA512
0c9adbaedde18b2213aab82bfabcad4af71a943751b434669c9df6b4c0fe13ca17e579ac6240bc2c966b8db26c85404af10fb1565953a101471062baf68af498
-
SSDEEP
24576:2TbBv5rUyXVlO8V8ikUJRQnpkPtG4HYy5hJoiJ4BUUCMmX8yvYs+UYFtaSlr3:IBJleiLOQNMbNqQs+UYF7
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1