Overview

overview

10

Static

static

10

fce441edb2...d6.exe

windows7-x64

10

fce441edb2...d6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6.exe

  • Size

    827KB

  • Sample

    240817-b72apstdrl

  • MD5

    73c1c41b9e71c48e752a5cd19fe808b6

  • SHA1

    b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

  • SHA256

    fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

  • SHA512

    f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

  • SSDEEP

    12288:JU3eNRedfgcpnS+rRBhJrppyCgDDJnqem1VC/Ucg:WuNRedfgl+rRBPwFqemEUcg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6.exe

    • Size

      827KB

    • MD5

      73c1c41b9e71c48e752a5cd19fe808b6

    • SHA1

      b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

    • SHA256

      fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

    • SHA512

      f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

    • SSDEEP

      12288:JU3eNRedfgcpnS+rRBhJrppyCgDDJnqem1VC/Ucg:WuNRedfgl+rRBPwFqemEUcg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks