Overview

overview

10

Static

static

HEUR-Troja...67.exe

windows7-x64

10

HEUR-Troja...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR-Trojan-PSW.MSIL.Reline.gen-f45baeadbd367.exe

  • Size

    1.5MB

  • Sample

    230122-qphg7sgb48

  • MD5

    142fc3f98e2b78474c392c72a6e4b826

  • SHA1

    85e4bf6f82e3bc640652df5982a937fa1457e541

  • SHA256

    f45baeadbd3670a3d6f0e5e5dd53325269153dcd02195c8d98d1a49db8a6b46c

  • SHA512

    f1c80e94cc0d3deb7302d98fd9349d90114ccf370ba29e89329797f43404daa38fedde38bf241e713b78da3c43fbefd32566b522bf89fef195dcd1442e4ae964

  • SSDEEP

    24576:fClaqwJlj0Wxxjb2dTGH7i3uOpK4KH/cKgphBhxqdvhm/Y3TnJ6f:fCqlj0exjxH7xn/WphBhg8A7J

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      HEUR-Trojan-PSW.MSIL.Reline.gen-f45baeadbd367.exe

    • Size

      1.5MB

    • MD5

      142fc3f98e2b78474c392c72a6e4b826

    • SHA1

      85e4bf6f82e3bc640652df5982a937fa1457e541

    • SHA256

      f45baeadbd3670a3d6f0e5e5dd53325269153dcd02195c8d98d1a49db8a6b46c

    • SHA512

      f1c80e94cc0d3deb7302d98fd9349d90114ccf370ba29e89329797f43404daa38fedde38bf241e713b78da3c43fbefd32566b522bf89fef195dcd1442e4ae964

    • SSDEEP

      24576:fClaqwJlj0Wxxjb2dTGH7i3uOpK4KH/cKgphBhxqdvhm/Y3TnJ6f:fCqlj0exjxH7xn/WphBhg8A7J

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks