dcrat

General

Target
SolaraBootstrapper.exe
Size 9.5MB
Sample240722-2lqvysshmp
SHA256 f9492af3afb78775082e480af744d660db9da8bc33c3ff63d869abf62d900f6e
MD5 81cc5781eddb3eac7b5ba88706a43cd8
SHA1 34db4fa4cb034f23586027fa59867058a0f79d23
SHA512 f2bf7b780a13ecbf5d684c015c94ced7936ad8dc8437f775ea4bf63d47890ec7907f975de95dade487ef2512b8dcef067239454782fd2b32db1631f4d23d9ac4
SSDEEP 196608:1E7JB0tYrXLW+d7UcIxptvyUQymRDSI1WCOK53Ie:1E9B0OjrdLK4J/tIe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  SolaraBootstrapper.exe
- Size 9.5MB
- SHA256 f9492af3afb78775082e480af744d660db9da8bc33c3ff63d869abf62d900f6e
- MD5 81cc5781eddb3eac7b5ba88706a43cd8
- SHA1 34db4fa4cb034f23586027fa59867058a0f79d23
- SHA512 f2bf7b780a13ecbf5d684c015c94ced7936ad8dc8437f775ea4bf63d47890ec7907f975de95dade487ef2512b8dcef067239454782fd2b32db1631f4d23d9ac4
- SSDEEP 196608:1E7JB0tYrXLW+d7UcIxptvyUQymRDSI1WCOK53Ie:1E9B0OjrdLK4J/tIe
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

dcrat xmrig execution infostealer miner persistence rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1