General
-
Target
dfc887cd89dd2ae06bf10f601fd238179929741e0140e045ed7c2c12c71a12e9N.exe
-
Size
1.3MB
-
Sample
250108-rn92hawjdl
-
MD5
c2aaf1077a6e5ee70912ab80c7fc42a0
-
SHA1
1aaf3d3e859c087778391240f31083103ef50506
-
SHA256
dfc887cd89dd2ae06bf10f601fd238179929741e0140e045ed7c2c12c71a12e9
-
SHA512
8dd372eeb1090050aff7ef9e3b0b538f8d97b16d7e605343d35ca81b09eb59afb9600a90fceea9e3f9ea34f7dd84e764e2514fb9c7b426d6a670c26e2886ac89
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
dfc887cd89dd2ae06bf10f601fd238179929741e0140e045ed7c2c12c71a12e9N.exe
-
Size
1.3MB
-
MD5
c2aaf1077a6e5ee70912ab80c7fc42a0
-
SHA1
1aaf3d3e859c087778391240f31083103ef50506
-
SHA256
dfc887cd89dd2ae06bf10f601fd238179929741e0140e045ed7c2c12c71a12e9
-
SHA512
8dd372eeb1090050aff7ef9e3b0b538f8d97b16d7e605343d35ca81b09eb59afb9600a90fceea9e3f9ea34f7dd84e764e2514fb9c7b426d6a670c26e2886ac89
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-