Overview

overview

10

Static

static

bc2612aeae...49.exe

windows7_x64

10

bc2612aeae...49.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc2612aeae58ca2f8eaee44f3da03e34fac8a6c95f5afc083d188587c684f349

  • Size

    2.9MB

  • Sample

    220520-176mvsegh7

  • MD5

    27ac58d73248ebb72b350a1d0642e866

  • SHA1

    88697d4f4d6e00a8ff29083a1a97c8d150f8939b

  • SHA256

    bc2612aeae58ca2f8eaee44f3da03e34fac8a6c95f5afc083d188587c684f349

  • SHA512

    db8c968b3415d02868bc0fb01cb6104504a058c3f6dd1769a8e56bb1c47ed830e2b8d8e9873cd6fbfd15dfff4d46999f1562cb06c8427d9b007108ad1793f998

Score
10/10
evasionsuricatatrojan

Malware Config

Targets

    • Target

      bc2612aeae58ca2f8eaee44f3da03e34fac8a6c95f5afc083d188587c684f349

    • Size

      2.9MB

    • MD5

      27ac58d73248ebb72b350a1d0642e866

    • SHA1

      88697d4f4d6e00a8ff29083a1a97c8d150f8939b

    • SHA256

      bc2612aeae58ca2f8eaee44f3da03e34fac8a6c95f5afc083d188587c684f349

    • SHA512

      db8c968b3415d02868bc0fb01cb6104504a058c3f6dd1769a8e56bb1c47ed830e2b8d8e9873cd6fbfd15dfff4d46999f1562cb06c8427d9b007108ad1793f998

    Score
    10/10
    evasionsuricatatrojan

    • suricata: ET MALWARE DCRat Initial CnC Activity

      suricata: ET MALWARE DCRat Initial CnC Activity

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks