Overview

overview

10

Static

static

10

231efb7ab5...c1.exe

windows7-x64

10

231efb7ab5...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    231efb7ab5b36cda91e06456480228c1.exe

  • Size

    1.3MB

  • Sample

    230608-kzfhpsdd79

  • MD5

    231efb7ab5b36cda91e06456480228c1

  • SHA1

    11edb782a254ead91bef459fb4dac0ca393ffeaf

  • SHA256

    5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d

  • SHA512

    c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017

  • SSDEEP

    24576:9urfikuV13mFFkwIuKOaZDIpw6P/KlBrJ/GB+8xNEJn:eiku13qF1jtpwG/KR/YxNEJ

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      231efb7ab5b36cda91e06456480228c1.exe

    • Size

      1.3MB

    • MD5

      231efb7ab5b36cda91e06456480228c1

    • SHA1

      11edb782a254ead91bef459fb4dac0ca393ffeaf

    • SHA256

      5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d

    • SHA512

      c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017

    • SSDEEP

      24576:9urfikuV13mFFkwIuKOaZDIpw6P/KlBrJ/GB+8xNEJn:eiku13qF1jtpwG/KR/YxNEJ

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks