Overview

overview

10

Static

static

10

17c93cd212...23.exe

windows7-x64

10

17c93cd212...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17c93cd212fba3b61aa7c3a6ff382c23.exe

  • Size

    2.6MB

  • Sample

    220925-en3afadbd7

  • MD5

    17c93cd212fba3b61aa7c3a6ff382c23

  • SHA1

    1f9e9f7e51dec2491210717cba4540fb15deb71e

  • SHA256

    333eab256391cecdda902d506952e1b4c83444f1ae3874e7092bcf41e62f8077

  • SHA512

    865001a8369a163d99496ccbcc812ff17ad655fb71821fb458ddc0fbe269ae78f3bdad7a676532aaee11bd72a697698353638b42ec0d85faa0853affe772bc73

  • SSDEEP

    49152:IpTn80rAHkSrvT7yEBpojAGw3fo+5D0gRbfGNW8UlbSpDCP2XF:IZpktrvTOqp2Nw3L0gRbfGI8sepeu1

Score
10/10
dcratevasioninfostealerratspywarestealertrojan

Malware Config

Targets

    • Target

      17c93cd212fba3b61aa7c3a6ff382c23.exe

    • Size

      2.6MB

    • MD5

      17c93cd212fba3b61aa7c3a6ff382c23

    • SHA1

      1f9e9f7e51dec2491210717cba4540fb15deb71e

    • SHA256

      333eab256391cecdda902d506952e1b4c83444f1ae3874e7092bcf41e62f8077

    • SHA512

      865001a8369a163d99496ccbcc812ff17ad655fb71821fb458ddc0fbe269ae78f3bdad7a676532aaee11bd72a697698353638b42ec0d85faa0853affe772bc73

    • SSDEEP

      49152:IpTn80rAHkSrvT7yEBpojAGw3fo+5D0gRbfGNW8UlbSpDCP2XF:IZpktrvTOqp2Nw3L0gRbfGI8sepeu1

    Score
    10/10
    dcratevasioninfostealerratspywarestealertrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks