Overview

overview

10

Static

static

245ed2db66...30.exe

windows7_x64

10

245ed2db66...30.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    245ed2db66c841556f3d7b52ab251030.exe

  • Size

    1.2MB

  • Sample

    220513-1c14wsbhb8

  • MD5

    245ed2db66c841556f3d7b52ab251030

  • SHA1

    8f12f472db36bf57ac7f2a02f21549d1559c672c

  • SHA256

    f698f53c372a26a4ab1ecd516064546fcd24da106293786c04e638de3582b2cd

  • SHA512

    6d5cdac70c9f090d472d4baa378c87d0bc7b582606f2767938b011401bfa6822cd7159c62ff58369c2d2c017654624a49134687879229f42673e4a785f47a0d6

Score
10/10
dcratinfostealerratsuricata

Malware Config

Targets

    • Target

      245ed2db66c841556f3d7b52ab251030.exe

    • Size

      1.2MB

    • MD5

      245ed2db66c841556f3d7b52ab251030

    • SHA1

      8f12f472db36bf57ac7f2a02f21549d1559c672c

    • SHA256

      f698f53c372a26a4ab1ecd516064546fcd24da106293786c04e638de3582b2cd

    • SHA512

      6d5cdac70c9f090d472d4baa378c87d0bc7b582606f2767938b011401bfa6822cd7159c62ff58369c2d2c017654624a49134687879229f42673e4a785f47a0d6

    Score
    10/10
    dcratinfostealerratsuricata

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • suricata: ET MALWARE DCRAT Activity (GET)

      suricata: ET MALWARE DCRAT Activity (GET)

      suricata

    • DCRat Payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks