Overview

overview

10

Static

static

10

7e65b2962b...e7.exe

windows7-x64

10

7e65b2962b...e7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.zip

  • Size

    924KB

  • Sample

    230321-rxbkasdb5z

  • MD5

    6abbcd563bd8a4930b2519dcdf3247a9

  • SHA1

    6979a49d3475168ee508be0e6273d432efb2ecb7

  • SHA256

    78ef720a295f0a09aa9c02eddc8f7ebdcfa5dc6355a3732b9dd5ab3e0d20e6c2

  • SHA512

    08eeb3eaab40a42190f8e6d64c32e2f83398a93db62f9075bfb374a48024edece519580fd02524f8a2e23af075e41ca0ec8a449084cf0f432f0e7d6ff4c8accf

  • SSDEEP

    24576:FGYd1SyEhwtuCJ3tH9kSxLK4j4cOvgcQsJu1TCVWhRk:Qm9ET+tH9y4jRO4ZTCV6Rk

Score
10/10
dcratevasioninfostealerratthemidatrojan

Malware Config

Targets

    • Target

      7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

    • Size

      1.9MB

    • MD5

      39dac645fb473abe88ebf3bb28e360b0

    • SHA1

      e2b8488b672d5765b404dc44f1ee6e0e005a2932

    • SHA256

      7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7

    • SHA512

      1f6d438429d1e7268fd9e757e2ae2af3a4418a700059cd69c712ed6dd0304bafc76400334a1a44fb45683908ec39bbfacfc2bf83e15ff2221de087e168dce6e2

    • SSDEEP

      24576:dCNqlizzN4yGwrXLoamoWvXa7IwfvoMODACOfCW2lPy1A9Qsy2lPy1A9QnG:UwgKyGwHthIwf7gOqW2wKQsy2wKQnG

    Score
    10/10
    dcratevasioninfostealerratthemidatrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks