Overview

overview

10

Static

static

10

9886d20dd6...4b.exe

windows7-x64

10

9886d20dd6...4b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9886d20dd6f3d896861cc5f8ea0ca84b

  • Size

    1.8MB

  • Sample

    240213-fkdcksde47

  • MD5

    9886d20dd6f3d896861cc5f8ea0ca84b

  • SHA1

    96ab3affa0279d5795a29f3e1ecae37546b8bb11

  • SHA256

    56ec9503792bc40353a2f197bb3a6561325d66dfe914573a9fea9ccdedd98929

  • SHA512

    02272f3a85b44fa8e6806356492109474c57c2d7da7f55cba4d93e4983162ed48582a73723d06689c9e89e87ba6ed8c30e409676669af0d8604d23288cfe8079

  • SSDEEP

    49152:UbA30gth6l+eGtUvcx+GXJsVXu6jFKpveKB:Ubkth6l8x+GX4erpvzB

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      9886d20dd6f3d896861cc5f8ea0ca84b

    • Size

      1.8MB

    • MD5

      9886d20dd6f3d896861cc5f8ea0ca84b

    • SHA1

      96ab3affa0279d5795a29f3e1ecae37546b8bb11

    • SHA256

      56ec9503792bc40353a2f197bb3a6561325d66dfe914573a9fea9ccdedd98929

    • SHA512

      02272f3a85b44fa8e6806356492109474c57c2d7da7f55cba4d93e4983162ed48582a73723d06689c9e89e87ba6ed8c30e409676669af0d8604d23288cfe8079

    • SSDEEP

      49152:UbA30gth6l+eGtUvcx+GXJsVXu6jFKpveKB:Ubkth6l8x+GX4erpvzB

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Modifies WinLogon for persistence

      persistence

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks