Overview

overview

10

Static

static

10

7c00e76d20...70.exe

windows7-x64

10

7c00e76d20...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70

  • Size

    1.3MB

  • Sample

    221122-jpyqvsee87

  • MD5

    e8ab7211bb9f1d8f7853a408c0c4237d

  • SHA1

    b201acf68589dce527a2f64496933a524a2a828f

  • SHA256

    7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70

  • SHA512

    fe3b7e3a3b9008aa802d7660b11c1a2b7b953cd222c99287ad891792c35bea51e1523f267e7b1cb0fe80cd140985a52f238fdba835f702b18ac58a00b1cd9c27

  • SSDEEP

    24576:U2G/nvxW3Ww0tiZJVZke3TAJ41sh2D0N6ZotQhiY3obwMGgp9FUQ:UbA30iDV6nJmTh3obXGgp9Fl

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70

    • Size

      1.3MB

    • MD5

      e8ab7211bb9f1d8f7853a408c0c4237d

    • SHA1

      b201acf68589dce527a2f64496933a524a2a828f

    • SHA256

      7c00e76d200bb61ac4ad205703541d6d9e11898333759fb876bd5fef0d1fed70

    • SHA512

      fe3b7e3a3b9008aa802d7660b11c1a2b7b953cd222c99287ad891792c35bea51e1523f267e7b1cb0fe80cd140985a52f238fdba835f702b18ac58a00b1cd9c27

    • SSDEEP

      24576:U2G/nvxW3Ww0tiZJVZke3TAJ41sh2D0N6ZotQhiY3obwMGgp9FUQ:UbA30iDV6nJmTh3obXGgp9Fl

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks