Overview

overview

10

Static

static

10

b698b62103...1c.exe

windows7-x64

10

b698b62103...1c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b698b62103e1985fbb1f03308a29a51c.exe

  • Size

    1.6MB

  • Sample

    230919-xsvp9sde74

  • MD5

    b698b62103e1985fbb1f03308a29a51c

  • SHA1

    2a880df0cf2d1cb5283a56fe2785e99c0bdc25e4

  • SHA256

    53f2d2af8c0582bb724f121d84118c1ccd973df05cafdee78ca915bc71ba1f80

  • SHA512

    f1959a0c0d2b7ecb96fd2ac5f7d929fe72aff2fc8c66c71fac4fadd6a6758bae9672cceae61eeca7b840995e76f8ef80c206d4169bb02f78c8625ddd3b1ddb9c

  • SSDEEP

    24576:U2G/nvxW3Ww0ttkMvbXnfo0mYXEUT0MJeROaaYhSmc/ILB43Jnzfj:UbA30tk6XnfBmUHYhSmrLBuB/

Score
10/10
dcratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      b698b62103e1985fbb1f03308a29a51c.exe

    • Size

      1.6MB

    • MD5

      b698b62103e1985fbb1f03308a29a51c

    • SHA1

      2a880df0cf2d1cb5283a56fe2785e99c0bdc25e4

    • SHA256

      53f2d2af8c0582bb724f121d84118c1ccd973df05cafdee78ca915bc71ba1f80

    • SHA512

      f1959a0c0d2b7ecb96fd2ac5f7d929fe72aff2fc8c66c71fac4fadd6a6758bae9672cceae61eeca7b840995e76f8ef80c206d4169bb02f78c8625ddd3b1ddb9c

    • SSDEEP

      24576:U2G/nvxW3Ww0ttkMvbXnfo0mYXEUT0MJeROaaYhSmc/ILB43Jnzfj:UbA30tk6XnfBmUHYhSmrLBuB/

    Score
    10/10
    dcratevasioninfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks