Overview

overview

10

Static

static

10

bc77f8df8e...74.exe

windows7-x64

10

bc77f8df8e...74.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc77f8df8e1dcb58a4142ee74.exe

  • Size

    828KB

  • Sample

    230704-q1nhlade78

  • MD5

    bc77f8df8e1dcb58a4142ee740803de9

  • SHA1

    c33ffa160a2d945b5c20dd0662a39ef666135e4c

  • SHA256

    ae3aa6d645818c7b732fa7a70ad6bbd9b48be4f2a46ab60a9fc2169b6c8c141e

  • SHA512

    e10cb92868bad8309a22b81fa421f8e8d90547800d64d594a2255238371c65c9a39ad8762960c9c4a9c85cab3db0551cd3893b62fe9bdcc0dbcd5d8b724447f5

  • SSDEEP

    12288:YnpgQaO+4y7PlLKnE2MoY0lHUkdiKLExUbtZ2jt7:WWQaO+42PlLKnEXoY0lViKYxIMp7

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      bc77f8df8e1dcb58a4142ee74.exe

    • Size

      828KB

    • MD5

      bc77f8df8e1dcb58a4142ee740803de9

    • SHA1

      c33ffa160a2d945b5c20dd0662a39ef666135e4c

    • SHA256

      ae3aa6d645818c7b732fa7a70ad6bbd9b48be4f2a46ab60a9fc2169b6c8c141e

    • SHA512

      e10cb92868bad8309a22b81fa421f8e8d90547800d64d594a2255238371c65c9a39ad8762960c9c4a9c85cab3db0551cd3893b62fe9bdcc0dbcd5d8b724447f5

    • SSDEEP

      12288:YnpgQaO+4y7PlLKnE2MoY0lHUkdiKLExUbtZ2jt7:WWQaO+42PlLKnEXoY0lViKYxIMp7

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks