General
-
Target
ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810
-
Size
885KB
-
Sample
241114-ld3a1szqen
-
MD5
eae6d4d5eae0cf85ff69eb89946e4185
-
SHA1
9107578b01297b583bf797575bea0d745d024260
-
SHA256
ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810
-
SHA512
14fbb35dc316eef0d11204280b8e152d54905f72e43f2f98d92cfca559f3d09dd7d849ea01ce1c57ab94d356b26d6146e6714a51d1f72af9d4d94fc0adba533f
-
SSDEEP
24576:9WUovLOqIJk8IjNJ/+z4F3osuiKoqsyol54bWYUK:9LoDP8IxF3osxKoqUK
Static task
static1
Behavioral task
behavioral1
Sample
ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810
-
Size
885KB
-
MD5
eae6d4d5eae0cf85ff69eb89946e4185
-
SHA1
9107578b01297b583bf797575bea0d745d024260
-
SHA256
ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810
-
SHA512
14fbb35dc316eef0d11204280b8e152d54905f72e43f2f98d92cfca559f3d09dd7d849ea01ce1c57ab94d356b26d6146e6714a51d1f72af9d4d94fc0adba533f
-
SSDEEP
24576:9WUovLOqIJk8IjNJ/+z4F3osuiKoqsyol54bWYUK:9LoDP8IxF3osxKoqUK
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Blocklisted process makes network request
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-