General
-
Target
cd1645ce66fa9706f19387bb054693e09247f5b3b665746ed3c25dbefcdfc22bN.exe
-
Size
1.3MB
-
Sample
250107-xmpl3awkcp
-
MD5
1323bfd5193c0637c1aba82cb6d9f0e0
-
SHA1
d7984f26ba391588ffd2c31540e98d503f6d2a23
-
SHA256
cd1645ce66fa9706f19387bb054693e09247f5b3b665746ed3c25dbefcdfc22b
-
SHA512
74412633546c8f5d93d576a74e07b8dc6d99f8092f065d689268c2aa7db1739a66ed6014acb80a08a5a0c699fe728265636218ba263aff33fd1abf463bcd5ad2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
cd1645ce66fa9706f19387bb054693e09247f5b3b665746ed3c25dbefcdfc22bN.exe
-
Size
1.3MB
-
MD5
1323bfd5193c0637c1aba82cb6d9f0e0
-
SHA1
d7984f26ba391588ffd2c31540e98d503f6d2a23
-
SHA256
cd1645ce66fa9706f19387bb054693e09247f5b3b665746ed3c25dbefcdfc22b
-
SHA512
74412633546c8f5d93d576a74e07b8dc6d99f8092f065d689268c2aa7db1739a66ed6014acb80a08a5a0c699fe728265636218ba263aff33fd1abf463bcd5ad2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-