Overview

overview

10

Static

static

417676e1e6...ca.exe

windows7-x64

10

417676e1e6...ca.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    417676e1e60786a52ff2df2e95b0efa8a77b35bf4e9a78fd033086a6e7db55ca

  • Size

    433KB

  • Sample

    230129-1af1yadd42

  • MD5

    2e421d1efddf596ee6487321df0ae484

  • SHA1

    38cdf0bd60efdb86c0ea363cfb3c5fbd2ddf997b

  • SHA256

    417676e1e60786a52ff2df2e95b0efa8a77b35bf4e9a78fd033086a6e7db55ca

  • SHA512

    72a642acfccfc83f84ab7723c9e5f31c678233d8959c11a8afcdc8a1f8e98940d33865a77ea93a4ec477bb068a9310b8d427e14f6078668d5ad578acdf65b247

  • SSDEEP

    12288:0Qnk3GDYKGcblwtX+t4Y8vd9CaOUG5Y+mh:IAOcZwXYO2J5zE

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      417676e1e60786a52ff2df2e95b0efa8a77b35bf4e9a78fd033086a6e7db55ca

    • Size

      433KB

    • MD5

      2e421d1efddf596ee6487321df0ae484

    • SHA1

      38cdf0bd60efdb86c0ea363cfb3c5fbd2ddf997b

    • SHA256

      417676e1e60786a52ff2df2e95b0efa8a77b35bf4e9a78fd033086a6e7db55ca

    • SHA512

      72a642acfccfc83f84ab7723c9e5f31c678233d8959c11a8afcdc8a1f8e98940d33865a77ea93a4ec477bb068a9310b8d427e14f6078668d5ad578acdf65b247

    • SSDEEP

      12288:0Qnk3GDYKGcblwtX+t4Y8vd9CaOUG5Y+mh:IAOcZwXYO2J5zE

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks