Malware sandboxing report by Hatching Triage

General

Target

tmp
Size

1MB
Sample

230531-nrq61sfa4s
MD5

8db8ac6d19be3b52641ea16e209b9ea4
SHA1

602bcfe9d5721eb745984cd78282493123a6cdf4
SHA256

e7dceabe18dfe33021fa25c3b804bc1301e59f76718742b5eb26f3979086c3e0
SHA512

301676215c3591ad203e141add1236f26fe999ee492e545d8b64f2047d11f5d2b5b210f8cf318bfdd1a53a215e02dcd14480e9d3508e021dec296e1dd255ed91
SSDEEP

24576:vFBr1R5kl7kHeIg+jQ0SBpxhtL6VEP5bCKCyzHAc:vX5yQ+IVUv5bCKCV

Score

10^/10

Malware Config

Targets

- Target
  
  tmp
- Size
  
  1MB
- MD5
  
  8db8ac6d19be3b52641ea16e209b9ea4
- SHA1
  
  602bcfe9d5721eb745984cd78282493123a6cdf4
- SHA256
  
  e7dceabe18dfe33021fa25c3b804bc1301e59f76718742b5eb26f3979086c3e0
- SHA512
  
  301676215c3591ad203e141add1236f26fe999ee492e545d8b64f2047d11f5d2b5b210f8cf318bfdd1a53a215e02dcd14480e9d3508e021dec296e1dd255ed91
- SSDEEP
  
  24576:vFBr1R5kl7kHeIg+jQ0SBpxhtL6VEP5bCKCyzHAc:vX5yQ+IVUv5bCKCV
Score

10^/10

dcrat discovery evasion infostealer persistence rat spyware stealer trojan
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2