Overview

overview

10

Static

static

10

7ba9547662...1f.exe

windows7-x64

10

7ba9547662...1f.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ba95476622ca5f8425317a34bbab2b33755bcdb37bb9dcc5d933fc5859ca81f.exe

  • Size

    1.1MB

  • Sample

    240821-mk49matcja

  • MD5

    198ba25ee66096e8560faa512dea17ce

  • SHA1

    c2eb2e7f10b7d690b83193016f822780a073fcb3

  • SHA256

    7ba95476622ca5f8425317a34bbab2b33755bcdb37bb9dcc5d933fc5859ca81f

  • SHA512

    a42da424fcc2f8ec67f6d616e1f5f2ecb86d57f9bc1cfe91a06fa788f21e8b130f002896cc43dc2f36cff329a58c50b7b9fd98af912542025d43e22df199ad7b

  • SSDEEP

    24576:59CwRt8HL7LJXzSmeSaT3VBdcFW2Xx37tOyp+:50wRt8zJAywyp

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      7ba95476622ca5f8425317a34bbab2b33755bcdb37bb9dcc5d933fc5859ca81f.exe

    • Size

      1.1MB

    • MD5

      198ba25ee66096e8560faa512dea17ce

    • SHA1

      c2eb2e7f10b7d690b83193016f822780a073fcb3

    • SHA256

      7ba95476622ca5f8425317a34bbab2b33755bcdb37bb9dcc5d933fc5859ca81f

    • SHA512

      a42da424fcc2f8ec67f6d616e1f5f2ecb86d57f9bc1cfe91a06fa788f21e8b130f002896cc43dc2f36cff329a58c50b7b9fd98af912542025d43e22df199ad7b

    • SSDEEP

      24576:59CwRt8HL7LJXzSmeSaT3VBdcFW2Xx37tOyp+:50wRt8zJAywyp

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks