dcrat

General

Target

PhasmophobiaCloud.rar
Size

15KB
Sample

220905-q3dfeaceh9
MD5

7bd746f9c8535ab26c16e8d8de2a4c94
SHA1

4e7eb424ae0da611035e849f82f568193f9283b2
SHA256

c8a76d75b71829e36543b0280eef65cfa88a4d1dcc2a58d1dadd3dbb96f2aa57
SHA512

4fa96e64a4399b1523ddc258a179ed40c0b79c84652a6f4e43f94e291d035d57b4cbba695446ae241e58b712631fc297a47b722b64cbd9385eaf646db1d8722b
SSDEEP

384:57CcLaksdr+jVqcOzvVo9v9vCj94GOuEn3bY7Buk:53Ca01V49+OuE3EJ

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

log

C2

195.3.223.79:33189

Targets

- Target
  
  PhasmophobiaCloud.bat
- Size
  
  24KB
- MD5
  
  1ae41cc13e1cb3aa4f2985ea9c9b8aa8
- SHA1
  
  e237b3d0c7d21e9040de93f8713d28b4869991ba
- SHA256
  
  48df2cb61d5530bfe02eb87fc3b837070f9d225175aa4dd08b2cf907d8d0bf41
- SHA512
  
  f056a50d6bdb994e65cb8e321f72e7de94d556a0560ba8c6aed7df58077daac873243a00f7360db7de5cc8ab904c452b562564e4a75c50f4f08aec9ebfd5c6c8
- SSDEEP
  
  384:n+1nSZBq9TfSaKScpLPfSgr34sow06KIZpg3dhC8H6NU/Q9Pq/b4uUIWIU6Jnlxb:nLa3KSEf54s7K4q3BpItKdnlu0p
Score

10^/10

dcrat redline log discovery evasion exploit infostealer rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies security service
  evasion
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2