dcrat | b155894733ade318a1448d83f693806ed14dec0378d03513ecab33971106a4ab | Triage

Sharing

General

Target

7609a834c94e791232efcf7fe8fe7df0_exe32.exe
Size

783KB
Sample

231015-ydbvaaec24
MD5

7609a834c94e791232efcf7fe8fe7df0
SHA1

d1d3e1755f5d4d264a7d5cf2fdb6f0bcd3afc61f
SHA256

b155894733ade318a1448d83f693806ed14dec0378d03513ecab33971106a4ab
SHA512

f093b654517987cd3c2d4576e0af7ac0eb5d917967ceab42f1cc5e2d0a14d731c54f6e32d24dcf052ffb2c7970fd3a7b7ff42d08d738dd8fdad05fb458e6a8b8
SSDEEP

12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Targets

- Target
  
  7609a834c94e791232efcf7fe8fe7df0_exe32.exe
- Size
  
  783KB
- MD5
  
  7609a834c94e791232efcf7fe8fe7df0
- SHA1
  
  d1d3e1755f5d4d264a7d5cf2fdb6f0bcd3afc61f
- SHA256
  
  b155894733ade318a1448d83f693806ed14dec0378d03513ecab33971106a4ab
- SHA512
  
  f093b654517987cd3c2d4576e0af7ac0eb5d917967ceab42f1cc5e2d0a14d731c54f6e32d24dcf052ffb2c7970fd3a7b7ff42d08d738dd8fdad05fb458e6a8b8
- SSDEEP
  
  12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q
Score

10^/10

dcrat evasion infostealer persistence rat trojan
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratevasioninfostealerpersistencerattrojan

behavioral2

dcratevasioninfostealerpersistencerattrojan