Overview

overview

10

Static

static

1

0788f92fd8...5d.exe

windows7-x64

10

0788f92fd8...5d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0788f92fd80bc11117bec239bb15755d.exe

  • Size

    765KB

  • Sample

    230301-3p43esab91

  • MD5

    0788f92fd80bc11117bec239bb15755d

  • SHA1

    10e4dd67943d8dfb22a223e0ce09597b5346144b

  • SHA256

    e265b6463579660b348a31ee258dbe9da699f5dbfd3649944ad4d2b61daf6cd1

  • SHA512

    3257b30d4527d0a0de2e7d89ce6e3afaebfa671b0392d4558a1b6fd364f64bb313d0a5472bbfaf4f269148f6b49ccd54ab2532ef5084c2548146ce7327087517

  • SSDEEP

    6144:nNg3uaSnrqUkT4CTAsc4gOL2+KKVxqFHa6fY++CyeSoSmF8OnFz1nCsLyyBA9whp:NKupNkTz7ufC4VUobBqBLku0cnCW

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      0788f92fd80bc11117bec239bb15755d.exe

    • Size

      765KB

    • MD5

      0788f92fd80bc11117bec239bb15755d

    • SHA1

      10e4dd67943d8dfb22a223e0ce09597b5346144b

    • SHA256

      e265b6463579660b348a31ee258dbe9da699f5dbfd3649944ad4d2b61daf6cd1

    • SHA512

      3257b30d4527d0a0de2e7d89ce6e3afaebfa671b0392d4558a1b6fd364f64bb313d0a5472bbfaf4f269148f6b49ccd54ab2532ef5084c2548146ce7327087517

    • SSDEEP

      6144:nNg3uaSnrqUkT4CTAsc4gOL2+KKVxqFHa6fY++CyeSoSmF8OnFz1nCsLyyBA9whp:NKupNkTz7ufC4VUobBqBLku0cnCW

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks