Overview

overview

10

Static

static

00019eb8bd...d5.exe

windows7-x64

10

00019eb8bd...d5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00019eb8bdb8bd7d36ba99b7f2b3bed5.exe

  • Size

    1.0MB

  • Sample

    230109-2chszsbe3v

  • MD5

    00019eb8bdb8bd7d36ba99b7f2b3bed5

  • SHA1

    7b1630ac115dd6800e11bd3d776456d55804e6fe

  • SHA256

    bf33833d77dd74a8a7fb751d6fa5da618440f3fb5447f8dd13e1893629a5b7dd

  • SHA512

    1f735ee1f99a1ad28f7a4fcec1787b3aeb7c3f550b041a8f26b224999074f8d388278e086c22ae8cb2183201b8d5494c13cb893d2ea128a62942c1e7f6be207b

  • SSDEEP

    24576:zAOEbDFEzOfXZFvokRtYp5h2ilqPMmUK5eHO8:zDEbJpFvoEYgilqPMmUKil

Score
10/10
dcratinfostealerpersistenceratspywarestealer

Malware Config

Targets

    • Target

      00019eb8bdb8bd7d36ba99b7f2b3bed5.exe

    • Size

      1.0MB

    • MD5

      00019eb8bdb8bd7d36ba99b7f2b3bed5

    • SHA1

      7b1630ac115dd6800e11bd3d776456d55804e6fe

    • SHA256

      bf33833d77dd74a8a7fb751d6fa5da618440f3fb5447f8dd13e1893629a5b7dd

    • SHA512

      1f735ee1f99a1ad28f7a4fcec1787b3aeb7c3f550b041a8f26b224999074f8d388278e086c22ae8cb2183201b8d5494c13cb893d2ea128a62942c1e7f6be207b

    • SSDEEP

      24576:zAOEbDFEzOfXZFvokRtYp5h2ilqPMmUK5eHO8:zDEbJpFvoEYgilqPMmUKil

    Score
    10/10
    dcratinfostealerpersistenceratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks