General
-
Target
e0a44f25632730e54db070a4508bdaf73621f4dc7f61987df2051d5d4b512ed7.exe
-
Size
2.3MB
-
Sample
240705-cbmm4szcmp
-
MD5
11ec2263423a6c9c8ca33fe4c021e9a4
-
SHA1
187934d7646cc1d33c923d1fbb0b385adbc411d1
-
SHA256
e0a44f25632730e54db070a4508bdaf73621f4dc7f61987df2051d5d4b512ed7
-
SHA512
d86b834a6554be6984222ddc926675e11df6d128841d51baba2f3b0e38ffcb08fdb7c01918a28c5db36c6c6c6799b8883a1131a9b41c5dc78a089c99151da4bf
-
SSDEEP
49152:q/OAn5V6k2DyNqLRN02tf1YkbY8TwHW47AFr3aT:uOs5VUCZ2tf1Ykk8TwHXerKT
Behavioral task
behavioral1
Sample
e0a44f25632730e54db070a4508bdaf73621f4dc7f61987df2051d5d4b512ed7.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e0a44f25632730e54db070a4508bdaf73621f4dc7f61987df2051d5d4b512ed7.exe
Resource
win10v2004-20240704-en
Malware Config
Targets
-
-
Target
e0a44f25632730e54db070a4508bdaf73621f4dc7f61987df2051d5d4b512ed7.exe
-
Size
2.3MB
-
MD5
11ec2263423a6c9c8ca33fe4c021e9a4
-
SHA1
187934d7646cc1d33c923d1fbb0b385adbc411d1
-
SHA256
e0a44f25632730e54db070a4508bdaf73621f4dc7f61987df2051d5d4b512ed7
-
SHA512
d86b834a6554be6984222ddc926675e11df6d128841d51baba2f3b0e38ffcb08fdb7c01918a28c5db36c6c6c6799b8883a1131a9b41c5dc78a089c99151da4bf
-
SSDEEP
49152:q/OAn5V6k2DyNqLRN02tf1YkbY8TwHW47AFr3aT:uOs5VUCZ2tf1Ykk8TwHXerKT
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-