dcrat

General

Target

https://oxy.st/d/koRh
Sample

240522-scgq9afb77

Score

10^/10

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%AppData%
install_file
Microsoft_WindowsDefender.exe
pastebin_url
https://pastebin.com/raw/dxKNAdeE
telegram
https://api.telegram.org/bot7013809678:AAEFwh-OW3w4YnEldOGR6NvGudG5gj8iF0Q/sendMessage?chat_id=5073217277

Targets

- Target
  
  https://oxy.st/d/koRh
Score

10^/10

dcrat xworm evasion execution infostealer persistence rat spyware stealer trojan upx
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Detect Xworm Payload
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1