Overview

overview

10

Static

static

HEUR-Troja...b6.exe

windows7-x64

10

HEUR-Troja...b6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR-Trojan-Spy.MSIL.Stealer.gen-b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6.exe

  • Size

    1.6MB

  • Sample

    221228-lby6ksaa63

  • MD5

    c2941309c33f19d5c2acc448e838b281

  • SHA1

    e929e9425de8df49806780664eec76df479f95b9

  • SHA256

    b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6

  • SHA512

    3ae53ac29729d7da962de103826b105fa785ab3b306c323abb9001e2ef107c320f37d1b807af608f174bb4786a42b050bd440ecd66b60614df3ae230263882e8

  • SSDEEP

    24576:oXGq9fNAehxNnn+MsgnUQ0+vgd9Ulk5R/+VKkccpScpuw72sEeh8Sx8y:FqVNxhxFVKQKHgk5RmVKG7dr

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      HEUR-Trojan-Spy.MSIL.Stealer.gen-b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6.exe

    • Size

      1.6MB

    • MD5

      c2941309c33f19d5c2acc448e838b281

    • SHA1

      e929e9425de8df49806780664eec76df479f95b9

    • SHA256

      b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6

    • SHA512

      3ae53ac29729d7da962de103826b105fa785ab3b306c323abb9001e2ef107c320f37d1b807af608f174bb4786a42b050bd440ecd66b60614df3ae230263882e8

    • SSDEEP

      24576:oXGq9fNAehxNnn+MsgnUQ0+vgd9Ulk5R/+VKkccpScpuw72sEeh8Sx8y:FqVNxhxFVKQKHgk5RmVKG7dr

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks