General
-
Target
1cdfb7c505c015641a936f6aad1b41fd8ded34e237891baa922c4c6a22d363d3.exe
-
Size
1.3MB
-
Sample
250107-kalnessnev
-
MD5
689d84536b36152faaff0f7071c80ff2
-
SHA1
a86ebd45d43a4168b0fa8919881fd5b6c664b98b
-
SHA256
1cdfb7c505c015641a936f6aad1b41fd8ded34e237891baa922c4c6a22d363d3
-
SHA512
b5a4dbbc683c23a0d368e0fbd743c553bd56231745c473d7f2274b04b6d403c1610a1cc5e04bb99c3c861cfddd866e145caa319c07d5f1038c73cb3c0b9c8024
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCD:UbA30GnzV/q+DnsXg1
Malware Config
Targets
-
-
Target
1cdfb7c505c015641a936f6aad1b41fd8ded34e237891baa922c4c6a22d363d3.exe
-
Size
1.3MB
-
MD5
689d84536b36152faaff0f7071c80ff2
-
SHA1
a86ebd45d43a4168b0fa8919881fd5b6c664b98b
-
SHA256
1cdfb7c505c015641a936f6aad1b41fd8ded34e237891baa922c4c6a22d363d3
-
SHA512
b5a4dbbc683c23a0d368e0fbd743c553bd56231745c473d7f2274b04b6d403c1610a1cc5e04bb99c3c861cfddd866e145caa319c07d5f1038c73cb3c0b9c8024
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCD:UbA30GnzV/q+DnsXg1
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-