Overview

overview

10

Static

static

10

3f4fe6774d...ca.exe

windows7-x64

10

3f4fe6774d...ca.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3f4fe6774def87f9863396e9658ada2e2ca054546bda713c9bccb92da9594aca.exe

  • Size

    1.1MB

  • Sample

    240503-bntfrabd91

  • MD5

    97a02921ff06b071f3a85c0e8cc98a80

  • SHA1

    9638ac7c260c4b02e66b16b2f23b048020aeb84b

  • SHA256

    3f4fe6774def87f9863396e9658ada2e2ca054546bda713c9bccb92da9594aca

  • SHA512

    6446cdbfccdeaa4f402e18b93bb41981ff55da2be3cff8190bc68a3f1228e0a15bb2c81a3c5b04901941c49749b10311a784d8692d1f18e5df93b2e7d1c84d3c

  • SSDEEP

    12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbEG5jtTrn0BGL81k/cX47Ct9lzIquqyWWg+j:U2G/nvxW3Ww0tb5jtTrnKGL81IGhNWrj

Score
10/10
dcratevasioninfostealerrat

Malware Config

Targets

    • Target

      3f4fe6774def87f9863396e9658ada2e2ca054546bda713c9bccb92da9594aca.exe

    • Size

      1.1MB

    • MD5

      97a02921ff06b071f3a85c0e8cc98a80

    • SHA1

      9638ac7c260c4b02e66b16b2f23b048020aeb84b

    • SHA256

      3f4fe6774def87f9863396e9658ada2e2ca054546bda713c9bccb92da9594aca

    • SHA512

      6446cdbfccdeaa4f402e18b93bb41981ff55da2be3cff8190bc68a3f1228e0a15bb2c81a3c5b04901941c49749b10311a784d8692d1f18e5df93b2e7d1c84d3c

    • SSDEEP

      12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbEG5jtTrn0BGL81k/cX47Ct9lzIquqyWWg+j:U2G/nvxW3Ww0tb5jtTrnKGL81IGhNWrj

    Score
    10/10
    dcratevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks