Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    1.3MB

  • Sample

    230526-mhhb3sfa57

  • MD5

    cf89d9b7de3c298b980138d2966af8f2

  • SHA1

    993f970437ca997455122eb638edcce52fd6785a

  • SHA256

    f466d39a4302e04f41f7b0b7c64f5e443c72f4725c5521f1e7825465442d8900

  • SHA512

    6cdfd4813a39ec9310e6356d920a261b4e29332f0d2a7e090b6fca4ba14692491fe12e6ab9a546b91a30e8b55628b75ab4a21c8815d3a1c7bae108c63025a250

  • SSDEEP

    24576:u2G/nvxW3WieCEoN4WsXJSxrcBfO/HknM5hjQ6Af:ubA3jleeoukM5yvf

Score
10/10
dcratevasioninfostealerrat

Malware Config

Targets

    • Target

      tmp

    • Size

      1.3MB

    • MD5

      cf89d9b7de3c298b980138d2966af8f2

    • SHA1

      993f970437ca997455122eb638edcce52fd6785a

    • SHA256

      f466d39a4302e04f41f7b0b7c64f5e443c72f4725c5521f1e7825465442d8900

    • SHA512

      6cdfd4813a39ec9310e6356d920a261b4e29332f0d2a7e090b6fca4ba14692491fe12e6ab9a546b91a30e8b55628b75ab4a21c8815d3a1c7bae108c63025a250

    • SSDEEP

      24576:u2G/nvxW3WieCEoN4WsXJSxrcBfO/HknM5hjQ6Af:ubA3jleeoukM5yvf

    Score
    10/10
    dcratevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks