dcrat | 70e310463aea47e2121969f8a96000a72c44ce574e2786a0e4d5e472ce35f998 | Triage

Submit
Reports

Overview

overview

Static

static

afb679b10d...46.exe

windows7-x64

afb679b10d...46.exe

windows10-2004-x64

Sharing

General

Target

afb679b10d49b2052e1239c345dee646.exe
Size

3.0MB
Sample

230127-anb12ahc8y
MD5

afb679b10d49b2052e1239c345dee646
SHA1

5cc8ce5753431b0cc4901aa53d8489e37a91c672
SHA256

70e310463aea47e2121969f8a96000a72c44ce574e2786a0e4d5e472ce35f998
SHA512

14983d548e071cd85973739f6056a9ab9ca3392f8f1aa3054ec05cfccaafd00135bfa1cdfc83fad26e5adee35c8f5d2d470e296eaba3cee8d7f7e896d47fb967
SSDEEP

49152:hwQVR+A3rrXAafICZyKC5iEqpVJ2pfexGqjNJ8JrSwAca2R7TQALtMiTdUdvVSMt:hwQVP7x6iEgBxVr8lMfkT1DBUdvge9Gi

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

afb679b10d49b2052e1239c345dee646.exe

Resource

win7-20220812-en

dcrat evasion infostealer rat spyware stealer trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

afb679b10d49b2052e1239c345dee646.exe

Resource

win10v2004-20220901-en

dcrat evasion infostealer persistence rat spyware stealer trojan

windows10-2004-x64

20 signatures

150 seconds

Malware Config

Targets

- Target
  
  afb679b10d49b2052e1239c345dee646.exe
- Size
  
  3.0MB
- MD5
  
  afb679b10d49b2052e1239c345dee646
- SHA1
  
  5cc8ce5753431b0cc4901aa53d8489e37a91c672
- SHA256
  
  70e310463aea47e2121969f8a96000a72c44ce574e2786a0e4d5e472ce35f998
- SHA512
  
  14983d548e071cd85973739f6056a9ab9ca3392f8f1aa3054ec05cfccaafd00135bfa1cdfc83fad26e5adee35c8f5d2d470e296eaba3cee8d7f7e896d47fb967
- SSDEEP
  
  49152:hwQVR+A3rrXAafICZyKC5iEqpVJ2pfexGqjNJ8JrSwAca2R7TQALtMiTdUdvVSMt:hwQVP7x6iEgBxVr8lMfkT1DBUdvge9Gi
Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan persistence
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Scheduled Task

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratevasioninfostealerratspywarestealertrojan

behavioral2

dcratevasioninfostealerpersistenceratspywarestealertrojan

© 2018-2024

Terms | Privacy