Overview

overview

10

Static

static

10

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    1.1MB

  • Sample

    230124-trcxaace99

  • MD5

    891e40a67cf2947614a49eac3e5da46f

  • SHA1

    e4d356ec2ff910b8d3e65d13eb44be72aefa6eb4

  • SHA256

    cd349d60bec07656d19b9c1c515ea91bf0b8479119efee85b695003e41016cb0

  • SHA512

    3cd15f70c1cc5b93203fad9c460cb2ed2c795afd96366a28d6dbc291f1972f5f0ac7712d41216376eb65a25cdc0a20a4702059634080fbf786c1f1315067b505

  • SSDEEP

    24576:u2G/nvxW3WieC48NP/nX2UYv1BmaH+a7BMq:ubA3jBHnGUYvNH+8

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      file.exe

    • Size

      1.1MB

    • MD5

      891e40a67cf2947614a49eac3e5da46f

    • SHA1

      e4d356ec2ff910b8d3e65d13eb44be72aefa6eb4

    • SHA256

      cd349d60bec07656d19b9c1c515ea91bf0b8479119efee85b695003e41016cb0

    • SHA512

      3cd15f70c1cc5b93203fad9c460cb2ed2c795afd96366a28d6dbc291f1972f5f0ac7712d41216376eb65a25cdc0a20a4702059634080fbf786c1f1315067b505

    • SSDEEP

      24576:u2G/nvxW3WieC48NP/nX2UYv1BmaH+a7BMq:ubA3jBHnGUYvNH+8

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks