Overview

overview

10

Static

static

urNhcPontS...a6.exe

windows7_x64

10

urNhcPontS...a6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    urNhcPontS3CqKADa6.exe

  • Size

    2.6MB

  • Sample

    220414-ytt1ssghc2

  • MD5

    891ad0c1d43d7921cf6e6f9ab73780f1

  • SHA1

    e08164a1a1739058bfb304579375939091d05486

  • SHA256

    daa70703ccb884159de7c78591d45460ba7a14692db872dd5c459c883acd02a3

  • SHA512

    966066e1162b774907c2ae6b0677fc0c94d50fcbe737064071c79f2744e0a860b63737539a8864222a01eeaa269b0aa138ff2611e91207005fca93f78320ffc5

Score
10/10
dcratmetastealerinfostealerpersistenceratspywarestealer

Malware Config

Targets

    • Target

      urNhcPontS3CqKADa6.exe

    • Size

      2.6MB

    • MD5

      891ad0c1d43d7921cf6e6f9ab73780f1

    • SHA1

      e08164a1a1739058bfb304579375939091d05486

    • SHA256

      daa70703ccb884159de7c78591d45460ba7a14692db872dd5c459c883acd02a3

    • SHA512

      966066e1162b774907c2ae6b0677fc0c94d50fcbe737064071c79f2744e0a860b63737539a8864222a01eeaa269b0aa138ff2611e91207005fca93f78320ffc5

    Score
    10/10
    dcratinfostealerpersistenceratspywarestealermetastealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

      stealermetastealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks