Overview

overview

10

Static

static

10

90cd882d4b...4a.exe

windows7-x64

10

90cd882d4b...4a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90cd882d4b7aa3939307bcc71bc05d38e600cb22e8984985335df1feac12e44a.exe

  • Size

    3.2MB

  • Sample

    240726-e4gzfazcje

  • MD5

    1c36a988c66b1b5e9ef74f4bacedadba

  • SHA1

    5591180c32f80e171c57f4be055000ad6f499351

  • SHA256

    90cd882d4b7aa3939307bcc71bc05d38e600cb22e8984985335df1feac12e44a

  • SHA512

    147b89dc5980149e53a8f7f1caa51185f443d2d779a8c20422b9a1fe5dc6c842c9ab4701b19c2dc5393cb530693ece583b09c370b6d229fbd84933af810f4df6

  • SSDEEP

    49152:a4iktlQ2cj9ScADsiz76m0JVqeUYfHuv4mDrsdWE2hnKQ9nO1zdhBFMGIEdY/0/w:aXktlQQsE49UguAiu2cp1zjLddZ9QY

Score
10/10
dcratevasioninfostealerrattrojan

Malware Config

Targets

    • Target

      90cd882d4b7aa3939307bcc71bc05d38e600cb22e8984985335df1feac12e44a.exe

    • Size

      3.2MB

    • MD5

      1c36a988c66b1b5e9ef74f4bacedadba

    • SHA1

      5591180c32f80e171c57f4be055000ad6f499351

    • SHA256

      90cd882d4b7aa3939307bcc71bc05d38e600cb22e8984985335df1feac12e44a

    • SHA512

      147b89dc5980149e53a8f7f1caa51185f443d2d779a8c20422b9a1fe5dc6c842c9ab4701b19c2dc5393cb530693ece583b09c370b6d229fbd84933af810f4df6

    • SSDEEP

      49152:a4iktlQ2cj9ScADsiz76m0JVqeUYfHuv4mDrsdWE2hnKQ9nO1zdhBFMGIEdY/0/w:aXktlQQsE49UguAiu2cp1zjLddZ9QY

    Score
    10/10
    dcratevasioninfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks