Overview

overview

10

Static

static

41937DB442...77.exe

windows7_x64

10

41937DB442...77.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    41937DB442356AFA8933D024EF8CC377.exe
  • Size 2.1MB
  • Sample220516-vkp4pseagn
  • SHA256 0aec2ca096ad5b30e9d542cdc96171de86ca12f0b9bc9066cc05de583adf5ad1
  • MD5 SHA1 SHA512
Score
10/10
dcratinfostealerratsuricata

Malware Config

Targets

    • Target
      41937DB442356AFA8933D024EF8CC377.exe
    • Size 2.1MB
    • SHA256 0aec2ca096ad5b30e9d542cdc96171de86ca12f0b9bc9066cc05de583adf5ad1
    • MD5 SHA1 SHA512
    Score
    10/10
    dcratinfostealerratsuricata

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE DCRAT Activity (GET)

      suricata: ET MALWARE DCRAT Activity (GET)

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks