Overview

overview

10

Static

static

10

HEUR-Troja...b4.exe

windows7-x64

10

HEUR-Troja...b4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe

  • Size

    608KB

  • Sample

    230720-ak16racd4y

  • MD5

    e8934df9ec508ad4eab478d511060d90

  • SHA1

    31582857d61047166558c92c166a6a903a09bf83

  • SHA256

    bd13041dfdb44e77eb2bc5d19ef39c05a7820010d36d2fede24d1ad330ae6daa

  • SHA512

    aecedefc6b269bfddfd9d61d91802686cfab2bea951563d2b74fb6841670f4d9e215ccab7f8953842be5a25f39dd3a034eb5cda52d54812e40f713a3465261f8

  • SSDEEP

    12288:QqnOi180YXNIIGSWAXb0ztt841j3RS/8A9rcF:Q+Oi1qNJGSnXb0zDu

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe

    • Size

      608KB

    • MD5

      e8934df9ec508ad4eab478d511060d90

    • SHA1

      31582857d61047166558c92c166a6a903a09bf83

    • SHA256

      bd13041dfdb44e77eb2bc5d19ef39c05a7820010d36d2fede24d1ad330ae6daa

    • SHA512

      aecedefc6b269bfddfd9d61d91802686cfab2bea951563d2b74fb6841670f4d9e215ccab7f8953842be5a25f39dd3a034eb5cda52d54812e40f713a3465261f8

    • SSDEEP

      12288:QqnOi180YXNIIGSWAXb0ztt841j3RS/8A9rcF:Q+Oi1qNJGSnXb0zDu

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks