Overview

overview

10

Static

static

3

F7DCB53C2C...D7.exe

windows7-x64

10

F7DCB53C2C...D7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    F7DCB53C2C0FFF4FA83CA2BE73ACB9D7.exe

  • Size

    1.8MB

  • Sample

    231016-nhv4lsdg2y

  • MD5

    f7dcb53c2c0fff4fa83ca2be73acb9d7

  • SHA1

    2089ad257388c2b30a0394e44b65161c748f12f5

  • SHA256

    658b0a01404144b5da03574e2a05b6c02030baa2276b9e047174c6ccb3e8918d

  • SHA512

    829bde29c94800ef9314b81b679354719f3cee5bd5cd67926edde885f35094f2652bd013bfa0e828166ab632c91cdd71cd5171da57fdbf35bd16c31013815992

  • SSDEEP

    49152:gqgWYHPoKznG6++0p7eFv+DswjGb8Z4l7Mb9WtRgg2:XrYfaI9apRW3

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      F7DCB53C2C0FFF4FA83CA2BE73ACB9D7.exe

    • Size

      1.8MB

    • MD5

      f7dcb53c2c0fff4fa83ca2be73acb9d7

    • SHA1

      2089ad257388c2b30a0394e44b65161c748f12f5

    • SHA256

      658b0a01404144b5da03574e2a05b6c02030baa2276b9e047174c6ccb3e8918d

    • SHA512

      829bde29c94800ef9314b81b679354719f3cee5bd5cd67926edde885f35094f2652bd013bfa0e828166ab632c91cdd71cd5171da57fdbf35bd16c31013815992

    • SSDEEP

      49152:gqgWYHPoKznG6++0p7eFv+DswjGb8Z4l7Mb9WtRgg2:XrYfaI9apRW3

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks