dcrat

General

Target

redirect
Size

6KB
Sample

240521-ytewwagg92
MD5

ceda84f20bde5c3b5c554bd819e1c381
SHA1

9ee3242ece7a3f075987b7fc9dad73db51dfd29b
SHA256

08cf615cded88dc7bc2f0575ddb3c05e1201f07f523ee7b119440a449f53ee7d
SHA512

a8d6cf26d88696b742790177802c747f6e966005a32d35d6cda438842d74e07b988c6d31a12c4d87062b25a5ac7df1f369963a093efe371f109858908b5f61e9
SSDEEP

192:dzHLxX7777/77QF7Ryrd0Lod4BYCIp8OOXI:dzr5HYK0+CIp8OOXI

Score

10^/10

Malware Config

Targets

- Target
  
  redirect
- Size
  
  6KB
- MD5
  
  ceda84f20bde5c3b5c554bd819e1c381
- SHA1
  
  9ee3242ece7a3f075987b7fc9dad73db51dfd29b
- SHA256
  
  08cf615cded88dc7bc2f0575ddb3c05e1201f07f523ee7b119440a449f53ee7d
- SHA512
  
  a8d6cf26d88696b742790177802c747f6e966005a32d35d6cda438842d74e07b988c6d31a12c4d87062b25a5ac7df1f369963a093efe371f109858908b5f61e9
- SSDEEP
  
  192:dzHLxX7777/77QF7Ryrd0Lod4BYCIp8OOXI:dzr5HYK0+CIp8OOXI
Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1