dcrat | 2576badffe87c022f36d203a6553b657a56bc86ec8f3a044b83f8d9d761df0d2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.08eb75af5d50ef3a4f602e90de74c660.exe
Size

783KB
Sample

231021-z2l6lacc54
MD5

08eb75af5d50ef3a4f602e90de74c660
SHA1

dd333a63bd79307e33d87540568f349a0681a9ce
SHA256

2576badffe87c022f36d203a6553b657a56bc86ec8f3a044b83f8d9d761df0d2
SHA512

36e7c9b512235588d21d6cb2197f297361580be434499b9aceccd3d7a24a33e0c60d28048add50a7129f57451f44fa49212174a2018eeb15b72b3442fe837a46
SSDEEP

12288:mqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:m+OQbpbgsFdAyQvzSqaq8q

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Targets

- Target
  
  NEAS.08eb75af5d50ef3a4f602e90de74c660.exe
- Size
  
  783KB
- MD5
  
  08eb75af5d50ef3a4f602e90de74c660
- SHA1
  
  dd333a63bd79307e33d87540568f349a0681a9ce
- SHA256
  
  2576badffe87c022f36d203a6553b657a56bc86ec8f3a044b83f8d9d761df0d2
- SHA512
  
  36e7c9b512235588d21d6cb2197f297361580be434499b9aceccd3d7a24a33e0c60d28048add50a7129f57451f44fa49212174a2018eeb15b72b3442fe837a46
- SSDEEP
  
  12288:mqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:m+OQbpbgsFdAyQvzSqaq8q
Score

10^/10

dcrat evasion infostealer persistence rat trojan
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratevasioninfostealerpersistencerattrojan

behavioral2

dcratevasioninfostealerpersistencerattrojan