Overview

overview

10

Static

static

10

cb54fe9938...17.exe

windows7-x64

10

cb54fe9938...17.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cb54fe9938168c64ee9dbdc0982a9917.exe

  • Size

    1.1MB

  • Sample

    221007-xlbzksdddr

  • MD5

    cb54fe9938168c64ee9dbdc0982a9917

  • SHA1

    9b9e8e726a5b85e4e5dd1393f6d7492715ff51e5

  • SHA256

    08b960976b9ab83018f62874758a07d07031182b60a682141bce7599e34e5981

  • SHA512

    170c95d305a9e4a0fb855d2f84cd501551eaa6424a5a56110c4e10f092278833df670ea0cb3f8362263ebf56e513aa1bcc662dab7e616849bf876e512fcbf28f

  • SSDEEP

    12288:qDNE5BggCqq44nBH9IB5SxyU6UD7/MoAhxEkNiwZG7Tn5jnv/7uTi3X1enGQtxRH:qDNb/JBH9e7mEhxFfGnNa/RABVKIDNG

Score
10/10
dcratinfostealerpersistenceratspywarestealer

Malware Config

Targets

    • Target

      cb54fe9938168c64ee9dbdc0982a9917.exe

    • Size

      1.1MB

    • MD5

      cb54fe9938168c64ee9dbdc0982a9917

    • SHA1

      9b9e8e726a5b85e4e5dd1393f6d7492715ff51e5

    • SHA256

      08b960976b9ab83018f62874758a07d07031182b60a682141bce7599e34e5981

    • SHA512

      170c95d305a9e4a0fb855d2f84cd501551eaa6424a5a56110c4e10f092278833df670ea0cb3f8362263ebf56e513aa1bcc662dab7e616849bf876e512fcbf28f

    • SSDEEP

      12288:qDNE5BggCqq44nBH9IB5SxyU6UD7/MoAhxEkNiwZG7Tn5jnv/7uTi3X1enGQtxRH:qDNb/JBH9e7mEhxFfGnNa/RABVKIDNG

    Score
    10/10
    dcratinfostealerpersistenceratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks