dcrat

General

Target

SolaraBootstrapper.exe
Size

9.5MB
Sample

240721-ydzaks1ena
MD5

7d9b8cef5925d1a700d720743bf61865
SHA1

10321760a98c0220be157441ae0516a5003ceba3
SHA256

1f3a8ed14dcf8dd8b4a88787b08163b9e9d65d999e61645b90c0c91b6a8f71fd
SHA512

793cf9f9641cd3c79fdba67af80d4ecf4b17ba4c151cc4696504740db64aaf309caeec1497273092a825e3543109f1172648193b9ae8a15d57b1501b74d2f8a9
SSDEEP

196608:ZE7JB0tYrXLW+d7UcIxptvyUQymRDSI1WCOK5d66w:ZE9B0OjrdLK4J/n66w

Score

10^/10

Malware Config

Targets

- Target
  
  SolaraBootstrapper.exe
- Size
  
  9.5MB
- MD5
  
  7d9b8cef5925d1a700d720743bf61865
- SHA1
  
  10321760a98c0220be157441ae0516a5003ceba3
- SHA256
  
  1f3a8ed14dcf8dd8b4a88787b08163b9e9d65d999e61645b90c0c91b6a8f71fd
- SHA512
  
  793cf9f9641cd3c79fdba67af80d4ecf4b17ba4c151cc4696504740db64aaf309caeec1497273092a825e3543109f1172648193b9ae8a15d57b1501b74d2f8a9
- SSDEEP
  
  196608:ZE7JB0tYrXLW+d7UcIxptvyUQymRDSI1WCOK5d66w:ZE9B0OjrdLK4J/n66w
Score

10^/10

dcrat xmrig execution infostealer miner persistence privilege_escalation rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1