Overview

overview

10

Static

static

10

CHEAT and ...ix.exe

windows7-x64

10

CHEAT and ...ix.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CHEAT and Bypass Matrix.exe

  • Size

    2.8MB

  • Sample

    230612-sp28qacg29

  • MD5

    642032685b8048204bf59668a7ed48c9

  • SHA1

    910555e0aa8b52cc5210f6523bde469f0f3e90fc

  • SHA256

    5ad5e035ba717e1db0bf6b1dde36d4da4a25d6156c3f51ca8c44ed075b57c043

  • SHA512

    91cc4c1c41dab2442b9b73b4e3196c780738aca8d2a186c4d6c3e7b63c7d9bfafce56962ffb395d070c1b7ec1e3b709bcb59c14fb9f513d5106310f6bd77b20c

  • SSDEEP

    49152:UbA30J2bjYDwitkxyOO1dHyWOdewRrirxMjvQI7OAax3Bd:UbNgjMJ2dyrybQI7Qzd

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      CHEAT and Bypass Matrix.exe

    • Size

      2.8MB

    • MD5

      642032685b8048204bf59668a7ed48c9

    • SHA1

      910555e0aa8b52cc5210f6523bde469f0f3e90fc

    • SHA256

      5ad5e035ba717e1db0bf6b1dde36d4da4a25d6156c3f51ca8c44ed075b57c043

    • SHA512

      91cc4c1c41dab2442b9b73b4e3196c780738aca8d2a186c4d6c3e7b63c7d9bfafce56962ffb395d070c1b7ec1e3b709bcb59c14fb9f513d5106310f6bd77b20c

    • SSDEEP

      49152:UbA30J2bjYDwitkxyOO1dHyWOdewRrirxMjvQI7OAax3Bd:UbNgjMJ2dyrybQI7Qzd

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks