Overview

overview

10

Static

static

10

0e6355f82f...cs.exe

windows7-x64

10

0e6355f82f...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0e6355f82f8de20bcf926df4ab225cd89ca402b2185858ed0ea26ec64998aed1NeikiAnalytics

  • Size

    1.4MB

  • Sample

    240526-sww1aaca39

  • MD5

    737221fdec6e3f072c9b4850adc00330

  • SHA1

    05619383fd9593015a6df245092d811133512c48

  • SHA256

    0e6355f82f8de20bcf926df4ab225cd89ca402b2185858ed0ea26ec64998aed1

  • SHA512

    b2da38708c3db796e520800fc37cb8915fd425a84ee964910df2a3fe1289b80b12b2610819233a2c13bdce3be7929736fd74002b148e7badd04f3e77d149ade8

  • SSDEEP

    24576:jwJfwwCPMBkgUQ8KaZhBvUO5VeRBJLpN/cNkNf9qwMjTmI:jwZdegxer9VKBFpBcNkbMj

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      0e6355f82f8de20bcf926df4ab225cd89ca402b2185858ed0ea26ec64998aed1NeikiAnalytics

    • Size

      1.4MB

    • MD5

      737221fdec6e3f072c9b4850adc00330

    • SHA1

      05619383fd9593015a6df245092d811133512c48

    • SHA256

      0e6355f82f8de20bcf926df4ab225cd89ca402b2185858ed0ea26ec64998aed1

    • SHA512

      b2da38708c3db796e520800fc37cb8915fd425a84ee964910df2a3fe1289b80b12b2610819233a2c13bdce3be7929736fd74002b148e7badd04f3e77d149ade8

    • SSDEEP

      24576:jwJfwwCPMBkgUQ8KaZhBvUO5VeRBJLpN/cNkNf9qwMjTmI:jwZdegxer9VKBFpBcNkbMj

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks