General
-
Target
cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe
-
Size
2.8MB
-
Sample
241230-c86r9avrbw
-
MD5
2397e7230770a20dd685f8903b0e7759
-
SHA1
bc280c16c4f89338df7c3745d0821432443d565c
-
SHA256
cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67
-
SHA512
97923122007bae611db6deb97e25a83f3636bec7c4d4d60aea2638edbeeaf85cef4c7c8755a442fd6525940154ec0d92258a65acdc065d75e1729b602510d7aa
-
SSDEEP
49152:Or8U+ST8nT/r5mZxSuCspYhU7F6511YoWN/qiUt9ETxJ5WGAf2VR:vSi/rwZYuCspQUA5vNWNqGfAGAA
Behavioral task
behavioral1
Sample
cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe
-
Size
2.8MB
-
MD5
2397e7230770a20dd685f8903b0e7759
-
SHA1
bc280c16c4f89338df7c3745d0821432443d565c
-
SHA256
cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67
-
SHA512
97923122007bae611db6deb97e25a83f3636bec7c4d4d60aea2638edbeeaf85cef4c7c8755a442fd6525940154ec0d92258a65acdc065d75e1729b602510d7aa
-
SSDEEP
49152:Or8U+ST8nT/r5mZxSuCspYhU7F6511YoWN/qiUt9ETxJ5WGAf2VR:vSi/rwZYuCspQUA5vNWNqGfAGAA
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1