Overview

overview

10

Static

static

URLScan

urlscan

https://disk.yandex....

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://disk.yandex.ru/d/JY1gwtKuh6QBqA

  • Sample

    210728-2145b5r5la

Score
10/10
dcratevasioninfostealerratspywarestealertrojan

Malware Config

Targets

    • Target

      https://disk.yandex.ru/d/JY1gwtKuh6QBqA

    Score
    10/10
    dcratevasioninfostealerratspywarestealertrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • DCRat Payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks