Overview

overview

10

Static

static

1

d6b8c1db03...cf.exe

windows7-x64

10

d6b8c1db03...cf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d6b8c1db03cd0f282e1718daf0dc35cf

  • Size

    978KB

  • Sample

    240319-v68g6sae9v

  • MD5

    d6b8c1db03cd0f282e1718daf0dc35cf

  • SHA1

    33435de2eb5be3e242bc75d3c6722e6e1a9b866c

  • SHA256

    7849b02c1912451ca4703361443e161953750e9783ee237985db9cafaff76c04

  • SHA512

    fa8bc7754009e447c1a87bd1e8183e5138eb2a637a6a3853f546af48a3564522b634341f2ed09117048f549953010c7fc4d67a72194121e23171f5f3f8746c27

  • SSDEEP

    24576:gHmSroFu1bU2XbykgUD5G5/XjaTG5lgUChKw9NQLH:gH7k4lyzBdToG5Wj9U

Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      d6b8c1db03cd0f282e1718daf0dc35cf

    • Size

      978KB

    • MD5

      d6b8c1db03cd0f282e1718daf0dc35cf

    • SHA1

      33435de2eb5be3e242bc75d3c6722e6e1a9b866c

    • SHA256

      7849b02c1912451ca4703361443e161953750e9783ee237985db9cafaff76c04

    • SHA512

      fa8bc7754009e447c1a87bd1e8183e5138eb2a637a6a3853f546af48a3564522b634341f2ed09117048f549953010c7fc4d67a72194121e23171f5f3f8746c27

    • SSDEEP

      24576:gHmSroFu1bU2XbykgUD5G5/XjaTG5lgUChKw9NQLH:gH7k4lyzBdToG5Wj9U

    Score
    10/10
    dcratevasioninfostealerpersistencerattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Nirsoft

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks