Overview

overview

10

Static

static

1

49086652f2...8e.exe

windows7-x64

10

49086652f2...8e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49086652f203c5698a87bc4a7ce6fd8e.exe

  • Size

    1.1MB

  • Sample

    230313-lfxhjsbf8s

  • MD5

    49086652f203c5698a87bc4a7ce6fd8e

  • SHA1

    a8cc3511a93c52824f67b5dece519ceced2f6e82

  • SHA256

    ace3286e12f4b3e483a878b85e20df0523e606d42ed52297706cbb933244256e

  • SHA512

    74fe0be5060c1d35abc781f83edc5fead6a7a6057dfd99632aa2fb277d11380f57bd9cbc6f8721fb144e7aec8ce3a745e587fe218279cde3889a00419cdf0c10

  • SSDEEP

    24576:6Yis4Yms1W3UhmdvT9fIaQTp9Wm7rUDtnA/:7is4ts1LhmhT+aQWm/UD9A/

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      49086652f203c5698a87bc4a7ce6fd8e.exe

    • Size

      1.1MB

    • MD5

      49086652f203c5698a87bc4a7ce6fd8e

    • SHA1

      a8cc3511a93c52824f67b5dece519ceced2f6e82

    • SHA256

      ace3286e12f4b3e483a878b85e20df0523e606d42ed52297706cbb933244256e

    • SHA512

      74fe0be5060c1d35abc781f83edc5fead6a7a6057dfd99632aa2fb277d11380f57bd9cbc6f8721fb144e7aec8ce3a745e587fe218279cde3889a00419cdf0c10

    • SSDEEP

      24576:6Yis4Yms1W3UhmdvT9fIaQTp9Wm7rUDtnA/:7is4ts1LhmhT+aQWm/UD9A/

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks