Overview

overview

10

Static

static

10

a0fe7c0a48...9d.exe

windows7-x64

10

a0fe7c0a48...9d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0fe7c0a48a3a0f88f52b82b6fca8d9d.exe

  • Size

    828KB

  • Sample

    230111-cwv5zsea8z

  • MD5

    a0fe7c0a48a3a0f88f52b82b6fca8d9d

  • SHA1

    27c8ef07a014b2e3ba7efa6542a4098de50ce582

  • SHA256

    1368c1a64455e8afed1c60f660f63e79b717be659c639f619d3591d684196aba

  • SHA512

    3d39b95b77b979b4b5e8723fe12380334c36eb553cd115a61455e699c600091ce17759771bbeea086429fcecdf7423607361236650aff8c6c8e2779c2f5a8782

  • SSDEEP

    12288:eRbgNHLA+BeYYUQ0Zf3ThR5CHcC9lxcLQQbpIQePMCxqo:+bArA+BeVUQ4f3gH1OLQOpIMCx3

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      a0fe7c0a48a3a0f88f52b82b6fca8d9d.exe

    • Size

      828KB

    • MD5

      a0fe7c0a48a3a0f88f52b82b6fca8d9d

    • SHA1

      27c8ef07a014b2e3ba7efa6542a4098de50ce582

    • SHA256

      1368c1a64455e8afed1c60f660f63e79b717be659c639f619d3591d684196aba

    • SHA512

      3d39b95b77b979b4b5e8723fe12380334c36eb553cd115a61455e699c600091ce17759771bbeea086429fcecdf7423607361236650aff8c6c8e2779c2f5a8782

    • SSDEEP

      12288:eRbgNHLA+BeYYUQ0Zf3ThR5CHcC9lxcLQQbpIQePMCxqo:+bArA+BeVUQ4f3gH1OLQOpIMCx3

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks