dcrat

General

Target

BloxPredictor.bat
Size

23KB
Sample

220824-xv1z3ahhep
MD5

e2553d84671dfa262938be551a620736
SHA1

6ce4843bf3262dc9cfd79a6b0aa26ff37b9f9dc0
SHA256

18ef1ace42ffd61934cbe66b9bd10c2ff14531f2602e66ce46a12c60d7a76f12
SHA512

49af6d4816f48a08588c45b31981d1da4e92365df13a57b40876561beb486ae5886b811575cd6cc45272c3903d49cb8818a780f449790a9fce5b90edddfa5400
SSDEEP

384:3S9YdseW63HBsPRtn9SXAiEZD4z7PwDjTqF+g/yv4iS9lKEHLtxL:iarW6xs3vD4fw/0+gKq1/L

Score

10^/10

Malware Config

Targets

- Target
  
  BloxPredictor.bat
- Size
  
  23KB
- MD5
  
  e2553d84671dfa262938be551a620736
- SHA1
  
  6ce4843bf3262dc9cfd79a6b0aa26ff37b9f9dc0
- SHA256
  
  18ef1ace42ffd61934cbe66b9bd10c2ff14531f2602e66ce46a12c60d7a76f12
- SHA512
  
  49af6d4816f48a08588c45b31981d1da4e92365df13a57b40876561beb486ae5886b811575cd6cc45272c3903d49cb8818a780f449790a9fce5b90edddfa5400
- SSDEEP
  
  384:3S9YdseW63HBsPRtn9SXAiEZD4z7PwDjTqF+g/yv4iS9lKEHLtxL:iarW6xs3vD4fw/0+gKq1/L
Score

10^/10

dcrat discovery evasion exploit infostealer persistence rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies security service
  evasion
- Modifies system executable filetype association
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateUserProcessOtherParentProcess
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Registers COM server for autorun
  persistence
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1