Overview

overview

10

Static

static

10

7fa58fd303...b3.exe

windows7-x64

10

7fa58fd303...b3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7fa58fd303e55a23ae5e9a068fbdb9866ab2a3d199a9b5d49893b7a972f321b3.exe

  • Size

    1.3MB

  • Sample

    240803-b48wdatcmd

  • MD5

    13d9c1c550ac72adac90d16aaf3550e2

  • SHA1

    db1fff9d282db7c4f6dd6f326fdd91f0551e73df

  • SHA256

    7fa58fd303e55a23ae5e9a068fbdb9866ab2a3d199a9b5d49893b7a972f321b3

  • SHA512

    64740c3e99111b779441eb96670396740bab53f90989ae5f178e9304a27653890f4311493a874e43e0ee6898794b7baafe87923fd647730c44c6c7d65e8c493f

  • SSDEEP

    24576:O2G/nvxW3WT00NEPGOLKGlwdEvwh5alN1Z8xtm:ObA3glOpPvcW18xw

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      7fa58fd303e55a23ae5e9a068fbdb9866ab2a3d199a9b5d49893b7a972f321b3.exe

    • Size

      1.3MB

    • MD5

      13d9c1c550ac72adac90d16aaf3550e2

    • SHA1

      db1fff9d282db7c4f6dd6f326fdd91f0551e73df

    • SHA256

      7fa58fd303e55a23ae5e9a068fbdb9866ab2a3d199a9b5d49893b7a972f321b3

    • SHA512

      64740c3e99111b779441eb96670396740bab53f90989ae5f178e9304a27653890f4311493a874e43e0ee6898794b7baafe87923fd647730c44c6c7d65e8c493f

    • SSDEEP

      24576:O2G/nvxW3WT00NEPGOLKGlwdEvwh5alN1Z8xtm:ObA3glOpPvcW18xw

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks