Overview

overview

10

Static

static

10

Ou6mS40OHr...aR.exe

windows7-x64

10

Ou6mS40OHr...aR.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ou6mS40OHrkbwQiM7ccaR.exe

  • Size

    2.4MB

  • Sample

    230127-d2nhrsgc78

  • MD5

    4ceeb0d068653ada01e702ba61dfdb7f

  • SHA1

    0e09a416c381e657f39af975f259d09da0324300

  • SHA256

    bfe4b2b5b1b9c2e8253848be27b277f1daf99314ff0ac964dc595bdef841a6c3

  • SHA512

    798904e3ef1ef5f898185577c2dc15dd8872f4e70f638f8f94f90846ac11eecbad72d843406512863d58a882df8ad40c02ad2d9daa6289f3c46fff724f5f1b73

  • SSDEEP

    24576:1RNpngHRc5DYZYLUsZ9p48N41XMFBDeQzC/tqELdO0U7TBd1X/SQOvjASm:PPDvx94V0eQuPdmJdV/J

Score
10/10
dcratevasioninfostealerrattrojan

Malware Config

Targets

    • Target

      Ou6mS40OHrkbwQiM7ccaR.exe

    • Size

      2.4MB

    • MD5

      4ceeb0d068653ada01e702ba61dfdb7f

    • SHA1

      0e09a416c381e657f39af975f259d09da0324300

    • SHA256

      bfe4b2b5b1b9c2e8253848be27b277f1daf99314ff0ac964dc595bdef841a6c3

    • SHA512

      798904e3ef1ef5f898185577c2dc15dd8872f4e70f638f8f94f90846ac11eecbad72d843406512863d58a882df8ad40c02ad2d9daa6289f3c46fff724f5f1b73

    • SSDEEP

      24576:1RNpngHRc5DYZYLUsZ9p48N41XMFBDeQzC/tqELdO0U7TBd1X/SQOvjASm:PPDvx94V0eQuPdmJdV/J

    Score
    10/10
    dcratevasioninfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks