Overview

overview

10

Static

static

900eb9fef2...a1.exe

windows7_x64

10

900eb9fef2...a1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    900eb9fef2464a9f9d8f8e6583bcb8a1.exe

  • Size

    1.4MB

  • Sample

    220130-13xt6abccq

  • MD5

    900eb9fef2464a9f9d8f8e6583bcb8a1

  • SHA1

    5941e80798f6aa3ea56bc4891494a27f55bb2c10

  • SHA256

    40fb662761491390c1e86e0e2d7cfc671b2239a5c3109ee0c76c963cf1f1fd62

  • SHA512

    2f3a72d450c35a96ed9ac40bd889cb558d42d15581d1df91857551dee7f7429ebaa4e6d67cfa8b1f56b590f924306d0ac35bbe880c33ff14933e28291aa2416e

Score
10/10
dcratinfostealerpersistenceratspywarestealersuricata

Malware Config

Targets

    • Target

      900eb9fef2464a9f9d8f8e6583bcb8a1.exe

    • Size

      1.4MB

    • MD5

      900eb9fef2464a9f9d8f8e6583bcb8a1

    • SHA1

      5941e80798f6aa3ea56bc4891494a27f55bb2c10

    • SHA256

      40fb662761491390c1e86e0e2d7cfc671b2239a5c3109ee0c76c963cf1f1fd62

    • SHA512

      2f3a72d450c35a96ed9ac40bd889cb558d42d15581d1df91857551dee7f7429ebaa4e6d67cfa8b1f56b590f924306d0ac35bbe880c33ff14933e28291aa2416e

    Score
    10/10
    dcratinfostealerpersistenceratspywarestealersuricata

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE DCRAT Activity (GET)

      suricata: ET MALWARE DCRAT Activity (GET)

      suricata

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks