Overview

overview

10

Static

static

1

Software v3.0.5.exe

windows7_x64

10

Software v3.0.5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Software v3.0.5.exe

  • Size

    910KB

  • Sample

    210722-kje9hprn8e

  • MD5

    56d73f0b8c89094a9f0ad6277f042b3d

  • SHA1

    6efe8b8257f030fdb63a069aad558b6282310a31

  • SHA256

    c6c9d678a3313c5bb7fe71194a2a1e4d3ffca2f04252dd1983ba657cfe17320e

  • SHA512

    6f003181b4118e421ec152f1297f7eb5f5e0b3276861c5ba8face20931aa75046dd95672f5120fc7f2acd65db69e0baaee0be7c3ed51a03ec3eab8b24c6a7379

Score
10/10
dcratxmriginfostealerminerratspywarestealer

Malware Config

Targets

    • Target

      Software v3.0.5.exe

    • Size

      910KB

    • MD5

      56d73f0b8c89094a9f0ad6277f042b3d

    • SHA1

      6efe8b8257f030fdb63a069aad558b6282310a31

    • SHA256

      c6c9d678a3313c5bb7fe71194a2a1e4d3ffca2f04252dd1983ba657cfe17320e

    • SHA512

      6f003181b4118e421ec152f1297f7eb5f5e0b3276861c5ba8face20931aa75046dd95672f5120fc7f2acd65db69e0baaee0be7c3ed51a03ec3eab8b24c6a7379

    Score
    10/10
    dcratxmriginfostealerminerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • DCRat Payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • XMRig Miner Payload

      miner

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks