Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b85168bf2297cd4243a987754257fbaebaf409fb04f3fd31f1c6f18c6f98398

  • Size

    1.1MB

  • Sample

    230122-r6blnaab3x

  • MD5

    d1a51393448d979468bee767ff7b1346

  • SHA1

    f7725410f3ca157cfa51eeee0d1e74ff247a5e29

  • SHA256

    4b85168bf2297cd4243a987754257fbaebaf409fb04f3fd31f1c6f18c6f98398

  • SHA512

    f828d72e5d7a8b1bee1b93ef2d8217eec05592c0909599d63b15112791f0db89db021c25b21ace64cf8fa678f115a088e9bee35bb8c89fbdd613463262861602

  • SSDEEP

    24576:U2G/nvxW3Ww0tEdrbS1zU+z9ujMu9uU4RPDbAIA:UbA30UXSvzP0p

Score
10/10
dcratevasioninfostealerrat

Malware Config

Targets

    • Target

      4b85168bf2297cd4243a987754257fbaebaf409fb04f3fd31f1c6f18c6f98398

    • Size

      1.1MB

    • MD5

      d1a51393448d979468bee767ff7b1346

    • SHA1

      f7725410f3ca157cfa51eeee0d1e74ff247a5e29

    • SHA256

      4b85168bf2297cd4243a987754257fbaebaf409fb04f3fd31f1c6f18c6f98398

    • SHA512

      f828d72e5d7a8b1bee1b93ef2d8217eec05592c0909599d63b15112791f0db89db021c25b21ace64cf8fa678f115a088e9bee35bb8c89fbdd613463262861602

    • SSDEEP

      24576:U2G/nvxW3Ww0tEdrbS1zU+z9ujMu9uU4RPDbAIA:UbA30UXSvzP0p

    Score
    10/10
    dcratevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks