Extracted

• • Target
    4e24fdbec5a768f78ad89177e71c4846.exe
  • Size 3.7MB
  • SHA256 fdef3bd7f14535f73bfcbe2741792c3c2c9cd10af69be1bd1bc1c41d5daeb71c
  • MD5 4e24fdbec5a768f78ad89177e71c4846
  • SHA1 db17fd6f2e44cebb01a93265779e623ec75dbffb
  • SHA512 9ee6cb4fe199a47d942e0591b30b20026fc9231e35ebf6f8528a2c720b7a8330fce4569ce5ca14478fc3e1a72b48ab9dcc9e7492149ec61ed397882f569648a1
  • SSDEEP 49152:bGEuq6liv5bT20EgaBojf0nMyPbCqbfgIpoXW85SAmCgVibEuYUZzMA/y8N7RDn6:aFqpbSdgaqADhpoXB5lbkHoNM9ZFv/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  dcratxwormevasioninfostealerpersistencerattrojan

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detect Xworm Payload

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2