Overview

overview

10

Static

static

10

run.exe

windows7-x64

10

run.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    run.exe

  • Size

    1.1MB

  • Sample

    240727-w41j8awepc

  • MD5

    b96afb3d55ec0f35c33a10eeaac8a895

  • SHA1

    87af52aa9415b8701382bdd28fa780167c8da39a

  • SHA256

    5ca78ff214c4c4c564bd3b6a23de1f6b5288d2b73473263c3fe53be7b2fe00a4

  • SHA512

    b4f773a7bcd4353517bcfe73bd9a8a42cf4bd0c5e96d161b8c111fdbfc9ad368aed903eb0ba4e7e7aa4d2f9d662d86b43f0d061685b47392fa631d195d1a89fe

  • SSDEEP

    24576:u2G/nvxW3WieCGvNNDBasL+tjITsX3kJ2VQVBu6fK9:ubA3j7sLLMW4

Score
10/10
dcratdiscoveryevasioninfostealerrat

Malware Config

Targets

    • Target

      run.exe

    • Size

      1.1MB

    • MD5

      b96afb3d55ec0f35c33a10eeaac8a895

    • SHA1

      87af52aa9415b8701382bdd28fa780167c8da39a

    • SHA256

      5ca78ff214c4c4c564bd3b6a23de1f6b5288d2b73473263c3fe53be7b2fe00a4

    • SHA512

      b4f773a7bcd4353517bcfe73bd9a8a42cf4bd0c5e96d161b8c111fdbfc9ad368aed903eb0ba4e7e7aa4d2f9d662d86b43f0d061685b47392fa631d195d1a89fe

    • SSDEEP

      24576:u2G/nvxW3WieCGvNNDBasL+tjITsX3kJ2VQVBu6fK9:ubA3j7sLLMW4

    Score
    10/10
    dcratdiscoveryevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks