General
-
Target
DCRat by C3lestial.fun.rar
-
Size
33.5MB
-
Sample
240612-x6k3zs1bnn
-
MD5
3112a622ece7c44b53c87e949af1ddd5
-
SHA1
a770bef606f2ca9927a9500c20bdbf77cc0fc820
-
SHA256
94e6c2037598e41f66f734e1e1e0934c1a167f5a9825d221dcc7c8dbdaaca6ff
-
SHA512
6b5ded758418832c45c5c5273ddea5cc1a92c466a50289f9920b2d781f0de55199582ab4667e35155a592cd786f1498bf8c8199bf59212c13ae4ae6cee646139
-
SSDEEP
786432:7gF2TX5HO7SWzCzw2HjIDuaMivz67rEhebp02lUrSRPTz+:G2TX5O79Wz9w2IzfAb0rSRP2
Static task
static1
Behavioral task
behavioral1
Sample
DCRat by C3lestial.fun.rar
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
DCRat by C3lestial.fun.rar
Resource
win10v2004-20240226-en
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1248497570939011083/iys0Q-I2H74ZeU8iK8mxnadLGnKvFVeC_daDGNMshULRzjYbAnJMv_etelbvONsTKIUG
Extracted
xworm
-
Install_directory
%Temp%
-
install_file
update.exe
-
pastebin_url
https://pastebin.com/raw/CNZj0axn
-
telegram
https://api.telegram.org/bot7009114103:AAGQ9PxSyhh1FE2I9esEeyfU9zAsNkooOqo/sendMessage?chat_id=1180155027
Targets
-
-
Target
DCRat by C3lestial.fun.rar
-
Size
33.5MB
-
MD5
3112a622ece7c44b53c87e949af1ddd5
-
SHA1
a770bef606f2ca9927a9500c20bdbf77cc0fc820
-
SHA256
94e6c2037598e41f66f734e1e1e0934c1a167f5a9825d221dcc7c8dbdaaca6ff
-
SHA512
6b5ded758418832c45c5c5273ddea5cc1a92c466a50289f9920b2d781f0de55199582ab4667e35155a592cd786f1498bf8c8199bf59212c13ae4ae6cee646139
-
SSDEEP
786432:7gF2TX5HO7SWzCzw2HjIDuaMivz67rEhebp02lUrSRPTz+:G2TX5O79Wz9w2IzfAb0rSRP2
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Umbral payload
-
Detect Xworm Payload
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2