Overview

overview

10

Static

static

ad7507c908...36.exe

windows7_x64

10

ad7507c908...36.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad7507c90821598ae3ed6e8b6c3fdb36.exe

  • Size

    1.3MB

  • Sample

    220120-qjy8rsabdk

  • MD5

    ad7507c90821598ae3ed6e8b6c3fdb36

  • SHA1

    b94839035eb055acacef724166489e2c0cb60eaa

  • SHA256

    785ebbdf0f15d1bb1fd3bbe1fb5a3486dead09dae463c91368653510c3814aee

  • SHA512

    ca43450c10e387a95ad6763e2f888096d7f87dc274bdb3f6720e4bc7fa3d214af72bc10a47f7ac2f00b44823511709ed1ad0f86201122bae3707c23463dff179

Score
10/10
dcratinfostealerpersistenceratspywarestealersuricata

Malware Config

Targets

    • Target

      ad7507c90821598ae3ed6e8b6c3fdb36.exe

    • Size

      1.3MB

    • MD5

      ad7507c90821598ae3ed6e8b6c3fdb36

    • SHA1

      b94839035eb055acacef724166489e2c0cb60eaa

    • SHA256

      785ebbdf0f15d1bb1fd3bbe1fb5a3486dead09dae463c91368653510c3814aee

    • SHA512

      ca43450c10e387a95ad6763e2f888096d7f87dc274bdb3f6720e4bc7fa3d214af72bc10a47f7ac2f00b44823511709ed1ad0f86201122bae3707c23463dff179

    Score
    10/10
    dcratinfostealerpersistenceratspywarestealersuricata

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE DCRAT Activity (GET)

      suricata: ET MALWARE DCRAT Activity (GET)

      suricata

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

2
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks