Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a9c9492f7270b60524d0973a2eaac7a7cd9a3d95a99da0d6356367acf11a9ad

  • Size

    1.3MB

  • Sample

    230203-kwt7pade24

  • MD5

    5eef88067efd87716a7c762a28165aad

  • SHA1

    fa947b8dc0cff20ed8b3ae2bd9ca257075601b82

  • SHA256

    6a9c9492f7270b60524d0973a2eaac7a7cd9a3d95a99da0d6356367acf11a9ad

  • SHA512

    70771fc529949bea59ad1e51ca3537788a53acd312e38c1a96d75ec43865d17b4cb53d1d1f174f20b9377c38d7979d964f4bccaec07596fd0ad0d3a93c1eef87

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      6a9c9492f7270b60524d0973a2eaac7a7cd9a3d95a99da0d6356367acf11a9ad

    • Size

      1.3MB

    • MD5

      5eef88067efd87716a7c762a28165aad

    • SHA1

      fa947b8dc0cff20ed8b3ae2bd9ca257075601b82

    • SHA256

      6a9c9492f7270b60524d0973a2eaac7a7cd9a3d95a99da0d6356367acf11a9ad

    • SHA512

      70771fc529949bea59ad1e51ca3537788a53acd312e38c1a96d75ec43865d17b4cb53d1d1f174f20b9377c38d7979d964f4bccaec07596fd0ad0d3a93c1eef87

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks