Overview

overview

10

Static

static

10

Cheat.exe

windows7-x64

10

Cheat.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cheat.exe

  • Size

    2.6MB

  • Sample

    240728-s8vyra1flp

  • MD5

    17e14b41efa937ec877b5d39fc6604d1

  • SHA1

    89dd1089a5f0764a6d304cfc880a03029fba5a67

  • SHA256

    226a0269af13171a409d03931b6012c8a9af097383953242128482df9d75f091

  • SHA512

    07c5173b49790d9b429058cc229682c35b28122c51080cec72e18350b5a72a4505cde53e22928acf027c9ad58a773f7850624d80bb1fb36e980a8f65d223f0e9

  • SSDEEP

    49152:ubA3jpCBIxCqgYLFD8WaJTjlsaQ7ygS1sJzJ/4rJ/Y9Yqu:ubspCqV8WOGvWF1sJ1/rYx

Score
10/10
dcratdiscoveryevasioninfostealerrat

Malware Config

Targets

    • Target

      Cheat.exe

    • Size

      2.6MB

    • MD5

      17e14b41efa937ec877b5d39fc6604d1

    • SHA1

      89dd1089a5f0764a6d304cfc880a03029fba5a67

    • SHA256

      226a0269af13171a409d03931b6012c8a9af097383953242128482df9d75f091

    • SHA512

      07c5173b49790d9b429058cc229682c35b28122c51080cec72e18350b5a72a4505cde53e22928acf027c9ad58a773f7850624d80bb1fb36e980a8f65d223f0e9

    • SSDEEP

      49152:ubA3jpCBIxCqgYLFD8WaJTjlsaQ7ygS1sJzJ/4rJ/Y9Yqu:ubspCqV8WOGvWF1sJ1/rYx

    Score
    10/10
    dcratdiscoveryevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks