Overview

overview

10

Static

static

10

492ea97a5e...2b.exe

windows7-x64

10

492ea97a5e...2b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    492ea97a5e145707a87cd019f102042b

  • Size

    1.2MB

  • Sample

    240107-rf6dcaggbl

  • MD5

    492ea97a5e145707a87cd019f102042b

  • SHA1

    e9b8c09b26921801d11fedb8426875c0cc59f0e4

  • SHA256

    3bfdd10fe2da7cb4dcff775df6897b3f5d4745391630640be7c388a816d649d1

  • SHA512

    06356125fa0071eb41c4074eba9c1610d03160954bcc27d24a507990f465207c2e21e31a433afaeaed36a59787c5441f476c0753f6e12ab19edff5ae214bfd1b

  • SSDEEP

    12288:6e+nZZPllEevpmjEdApnSavNYkHN2nG9mAKKCVUy0XKKtOpCG0J3jK5MKYXqn4:/CeIQrSavmGcAKnVUHK5b0Jzf5X+4

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      492ea97a5e145707a87cd019f102042b

    • Size

      1.2MB

    • MD5

      492ea97a5e145707a87cd019f102042b

    • SHA1

      e9b8c09b26921801d11fedb8426875c0cc59f0e4

    • SHA256

      3bfdd10fe2da7cb4dcff775df6897b3f5d4745391630640be7c388a816d649d1

    • SHA512

      06356125fa0071eb41c4074eba9c1610d03160954bcc27d24a507990f465207c2e21e31a433afaeaed36a59787c5441f476c0753f6e12ab19edff5ae214bfd1b

    • SSDEEP

      12288:6e+nZZPllEevpmjEdApnSavNYkHN2nG9mAKKCVUy0XKKtOpCG0J3jK5MKYXqn4:/CeIQrSavmGcAKnVUHK5b0Jzf5X+4

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks