Overview

overview

10

Static

static

10

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    1.3MB

  • Sample

    230120-q8p2dsga5t

  • MD5

    934aa4002b72b19928b22b6c30bb8595

  • SHA1

    a579d9b225d963502628f5243e488121e46523e8

  • SHA256

    b115cd83f8cf97a23b8cc34503f2b63ff6417f0235f3b0e9e0fba5265408a918

  • SHA512

    f5b78fba8399ddd3f6d6d7813c212df0fafd62d11f6080e396923c44e13eb077e3c915481ffb431f3f0725964a45bb7059ef27bc8dfd26d51c5dbaab19342628

  • SSDEEP

    24576:U2G/nvxW3Ww0tj3V/qPP9MXplBI1w2HBxTLGmKhGYrBM6:UbA30j39qa1KJYrBL

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      file.exe

    • Size

      1.3MB

    • MD5

      934aa4002b72b19928b22b6c30bb8595

    • SHA1

      a579d9b225d963502628f5243e488121e46523e8

    • SHA256

      b115cd83f8cf97a23b8cc34503f2b63ff6417f0235f3b0e9e0fba5265408a918

    • SHA512

      f5b78fba8399ddd3f6d6d7813c212df0fafd62d11f6080e396923c44e13eb077e3c915481ffb431f3f0725964a45bb7059ef27bc8dfd26d51c5dbaab19342628

    • SSDEEP

      24576:U2G/nvxW3Ww0tj3V/qPP9MXplBI1w2HBxTLGmKhGYrBM6:UbA30j39qa1KJYrBL

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks