Overview

overview

10

Static

static

10

Loader.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader.exe

  • Size

    1.7MB

  • Sample

    210728-fbeg18jy2a

  • MD5

    e44153fbc8eb2869e5eed232cf084427

  • SHA1

    844d785dc829228f34bd4c77c27ce6a87766f287

  • SHA256

    75739212f39d025329e1c4594f8e2b5be07402bef199b342b459d88bfeaf88cb

  • SHA512

    0034dc469c601cb8688241dcfb4afc36761d536d4d252f58083105afc97b9c460f39764cf142cd03f71b008c3391c28fd4585b58502a31919f8735b25692097c

Score
10/10
dcratevasioninfostealerratspywarestealertrojan

Malware Config

Targets

    • Target

      Loader.exe

    • Size

      1.7MB

    • MD5

      e44153fbc8eb2869e5eed232cf084427

    • SHA1

      844d785dc829228f34bd4c77c27ce6a87766f287

    • SHA256

      75739212f39d025329e1c4594f8e2b5be07402bef199b342b459d88bfeaf88cb

    • SHA512

      0034dc469c601cb8688241dcfb4afc36761d536d4d252f58083105afc97b9c460f39764cf142cd03f71b008c3391c28fd4585b58502a31919f8735b25692097c

    Score
    10/10
    dcratevasioninfostealerratspywarestealertrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • DCRat Payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks