dcrat

General

Target
09eef44272d050d8054cf913ed7bbf48.exe
Size 3.2MB
Sample240310-mxtnnabb81
SHA256 87f220dad3bbeec6f39ed3e74eaa5b63f91924104b238fd33b4c5d49cc88f1ac
MD5 09eef44272d050d8054cf913ed7bbf48
SHA1 b4cd2add18e8445529b107d5ee847b89c70db333
SHA512 867189c8cde505c22c377d4b68665c235e019b7127b3dbfdf4babdf8cd67985753898945d767c99122b3fe348b768e1e11bf3c340feedc0182c4c584a20ecf30
SSDEEP 98304:Cc8eC24luyRsHatJTnXk8AkY9/7x0go6/e6BJ4:9kuyRsHSXk777oq3U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  09eef44272d050d8054cf913ed7bbf48.exe
- Size 3.2MB
- SHA256 87f220dad3bbeec6f39ed3e74eaa5b63f91924104b238fd33b4c5d49cc88f1ac
- MD5 09eef44272d050d8054cf913ed7bbf48
- SHA1 b4cd2add18e8445529b107d5ee847b89c70db333
- SHA512 867189c8cde505c22c377d4b68665c235e019b7127b3dbfdf4babdf8cd67985753898945d767c99122b3fe348b768e1e11bf3c340feedc0182c4c584a20ecf30
- SSDEEP 98304:Cc8eC24luyRsHatJTnXk8AkY9/7x0go6/e6BJ4:9kuyRsHSXk777oq3U
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer trojan
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral1 behavioral2