Overview

overview

10

Static

static

10

8200E9229E...1E.exe

windows7_x64

10

8200E9229E...1E.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8200E9229E3BCBDE18EB0BE7E90A691E.exe

  • Size

    1.1MB

  • Sample

    210702-4gexxxz3cx

  • MD5

    8200e9229e3bcbde18eb0be7e90a691e

  • SHA1

    bbe63015b898a1bdc94057e1efcd79c351897ff4

  • SHA256

    88771c803925c9b53a6eeedbf38e34bbb20cc6ab5861ca8789b1efbdda0cbbb2

  • SHA512

    e0b00b71c1737eb3fc9b5f86fb2f8bc11a1e05cfa57572923736d37cbf1ef0aa6497220084503745d95d93adc78d0d66e8cdea28ed713eeee92b295b66bf7c1f

Score
10/10
dcratxmriginfostealerminerratspywarestealer

Malware Config

Targets

    • Target

      8200E9229E3BCBDE18EB0BE7E90A691E.exe

    • Size

      1.1MB

    • MD5

      8200e9229e3bcbde18eb0be7e90a691e

    • SHA1

      bbe63015b898a1bdc94057e1efcd79c351897ff4

    • SHA256

      88771c803925c9b53a6eeedbf38e34bbb20cc6ab5861ca8789b1efbdda0cbbb2

    • SHA512

      e0b00b71c1737eb3fc9b5f86fb2f8bc11a1e05cfa57572923736d37cbf1ef0aa6497220084503745d95d93adc78d0d66e8cdea28ed713eeee92b295b66bf7c1f

    Score
    10/10
    dcratxmriginfostealerminerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • DCRat Payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks