General
-
Target
b9ab7468de784cdab90190a6aa2d2071d733487cb331e41276f1d497e2d985f5N.exe
-
Size
1.7MB
-
Sample
250111-zdm3zs1ldm
-
MD5
e925545425c1bb324afb86cbf84ba820
-
SHA1
125c717a690986a94e3a6575086e7f6f07b34c55
-
SHA256
b9ab7468de784cdab90190a6aa2d2071d733487cb331e41276f1d497e2d985f5
-
SHA512
80d676851c7076dfbd29f5de351337d0c32fac9f2652fdcac7eccc3652fabc401a1a8e865b628ac50aa69b9259481a45483205c5ae22c3ce6f2352548ae06ec3
-
SSDEEP
49152:j+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:OTHUxUoh1IF9gl2
Behavioral task
behavioral1
Sample
b9ab7468de784cdab90190a6aa2d2071d733487cb331e41276f1d497e2d985f5N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b9ab7468de784cdab90190a6aa2d2071d733487cb331e41276f1d497e2d985f5N.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
b9ab7468de784cdab90190a6aa2d2071d733487cb331e41276f1d497e2d985f5N.exe
-
Size
1.7MB
-
MD5
e925545425c1bb324afb86cbf84ba820
-
SHA1
125c717a690986a94e3a6575086e7f6f07b34c55
-
SHA256
b9ab7468de784cdab90190a6aa2d2071d733487cb331e41276f1d497e2d985f5
-
SHA512
80d676851c7076dfbd29f5de351337d0c32fac9f2652fdcac7eccc3652fabc401a1a8e865b628ac50aa69b9259481a45483205c5ae22c3ce6f2352548ae06ec3
-
SSDEEP
49152:j+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:OTHUxUoh1IF9gl2
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-