Overview

overview

10

Static

static

10

27e28c0509...3f.exe

windows7-x64

10

27e28c0509...3f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27e28c0509f0685673ae9435e44f163f.exe

  • Size

    929KB

  • Sample

    230716-mbxs7afa8x

  • MD5

    27e28c0509f0685673ae9435e44f163f

  • SHA1

    384c365e6ceff71f94038c19d6dd72451b128576

  • SHA256

    122f5fbdf16a82a90c358ec2e39933e8a5ef43d76cb4fd63ae68863023ecfa01

  • SHA512

    1cbd42612aee9f5cffb6a55155f397cb657d807955d26fec742041649c359b9c48acf128f0c7e4a866497854153f333e75d3bf613a6f52d7f0836ddbb295cb20

  • SSDEEP

    12288:jpLIRXM1We9wDdtSF4j7nvLaMfUyciwQUXUtqRrjK2QSaDcy11wZPiAQqn4:CtUkqRrQH3wZW+4

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      27e28c0509f0685673ae9435e44f163f.exe

    • Size

      929KB

    • MD5

      27e28c0509f0685673ae9435e44f163f

    • SHA1

      384c365e6ceff71f94038c19d6dd72451b128576

    • SHA256

      122f5fbdf16a82a90c358ec2e39933e8a5ef43d76cb4fd63ae68863023ecfa01

    • SHA512

      1cbd42612aee9f5cffb6a55155f397cb657d807955d26fec742041649c359b9c48acf128f0c7e4a866497854153f333e75d3bf613a6f52d7f0836ddbb295cb20

    • SSDEEP

      12288:jpLIRXM1We9wDdtSF4j7nvLaMfUyciwQUXUtqRrjK2QSaDcy11wZPiAQqn4:CtUkqRrQH3wZW+4

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks