Overview

overview

10

Static

static

10

787F845B90...C0.exe

windows7_x64

787F845B90...C0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    787F845B904FD7FC0F36F5CCAB9691C0.exe

  • Size

    1.5MB

  • Sample

    210620-pkxxltnrns

  • MD5

    787f845b904fd7fc0f36f5ccab9691c0

  • SHA1

    d25cd2bf2986862d7c4d5923a144b5c6d11690ac

  • SHA256

    a7629346a7228cd9b9d1db57a2d25c12c87506db851f43dd99fcb5e8f0e520ec

  • SHA512

    05ab7acb67cd7852620a4e835ebaadbe1b709c01dd025e701be7ec04c63abc4b8e045f50911c6aa0f7253c3b1349a0174f08fd0f54b5d0fed9524c719c6135d3

Score
10/10
dcratxmriginfostealerminerratspywarestealer

Malware Config

Targets

    • Target

      787F845B904FD7FC0F36F5CCAB9691C0.exe

    • Size

      1.5MB

    • MD5

      787f845b904fd7fc0f36f5ccab9691c0

    • SHA1

      d25cd2bf2986862d7c4d5923a144b5c6d11690ac

    • SHA256

      a7629346a7228cd9b9d1db57a2d25c12c87506db851f43dd99fcb5e8f0e520ec

    • SHA512

      05ab7acb67cd7852620a4e835ebaadbe1b709c01dd025e701be7ec04c63abc4b8e045f50911c6aa0f7253c3b1349a0174f08fd0f54b5d0fed9524c719c6135d3

    Score
    10/10
    dcratxmriginfostealerminerratspywarestealer

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • DCRat Payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks