Overview

overview

10

Static

static

3

0edf51664b...86.exe

windows7-x64

7

0edf51664b...86.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0edf51664b0a45acdce457d9a8cdc386.exe

  • Size

    8.5MB

  • Sample

    230615-lrmgqaff9y

  • MD5

    0edf51664b0a45acdce457d9a8cdc386

  • SHA1

    d7b0fbca408089089dc4cbf6482bac3599d9fba0

  • SHA256

    67eeefd5e0497fbdc04b51cfbb76efae169c3875c67620ebaa13c62ece5edf15

  • SHA512

    0cf3b0d3568c5cf3f442bee42bdbfccb5e576fa1f5abb14f2a1427dc3d85d54c5b55d3df75ea9dc39d2bc3c688fa4ede24663ff7af7e66debd474b26aa2fad2d

  • SSDEEP

    196608:Ck6YzLe5c91ELY0JDfyGZ21X5Sp6GemDMPwuWJYPnkRo:PLt96Y0JDfD0pfaMPWTo

Score
10/10
dcratinfostealerpyinstallerratspywarestealer

Malware Config

Targets

    • Target

      0edf51664b0a45acdce457d9a8cdc386.exe

    • Size

      8.5MB

    • MD5

      0edf51664b0a45acdce457d9a8cdc386

    • SHA1

      d7b0fbca408089089dc4cbf6482bac3599d9fba0

    • SHA256

      67eeefd5e0497fbdc04b51cfbb76efae169c3875c67620ebaa13c62ece5edf15

    • SHA512

      0cf3b0d3568c5cf3f442bee42bdbfccb5e576fa1f5abb14f2a1427dc3d85d54c5b55d3df75ea9dc39d2bc3c688fa4ede24663ff7af7e66debd474b26aa2fad2d

    • SSDEEP

      196608:Ck6YzLe5c91ELY0JDfyGZ21X5Sp6GemDMPwuWJYPnkRo:PLt96Y0JDfD0pfaMPWTo

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks