Overview

overview

10

Static

static

10

ddc06f933d...2f.exe

windows7-x64

10

ddc06f933d...2f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ddc06f933da13bef9bd6f6cbc1d63817671cc34957a4e19f8e5e046bcb4b772f.exe

  • Size

    827KB

  • Sample

    241009-r1gkqaxbqq

  • MD5

    3d1284856779580aa24ff1c338c265da

  • SHA1

    2d2e0de25e7c496613bdd59081b54cb18871d582

  • SHA256

    ddc06f933da13bef9bd6f6cbc1d63817671cc34957a4e19f8e5e046bcb4b772f

  • SHA512

    e9c077e5551cb0e37ca0bbd1d9ee3b8f84d2d270924e172eb3ec089feca74d1226573064b3ad5b2376b9d431b82f9d22d81e2722ff13b734f81a3f16e5977694

  • SSDEEP

    12288:nv6zCmZBiI6kHeUTUVAgDd0AqoU3gQaA0lO:nFmZBiu+UTUSgD2AWYlO

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      ddc06f933da13bef9bd6f6cbc1d63817671cc34957a4e19f8e5e046bcb4b772f.exe

    • Size

      827KB

    • MD5

      3d1284856779580aa24ff1c338c265da

    • SHA1

      2d2e0de25e7c496613bdd59081b54cb18871d582

    • SHA256

      ddc06f933da13bef9bd6f6cbc1d63817671cc34957a4e19f8e5e046bcb4b772f

    • SHA512

      e9c077e5551cb0e37ca0bbd1d9ee3b8f84d2d270924e172eb3ec089feca74d1226573064b3ad5b2376b9d431b82f9d22d81e2722ff13b734f81a3f16e5977694

    • SSDEEP

      12288:nv6zCmZBiI6kHeUTUVAgDd0AqoU3gQaA0lO:nFmZBiu+UTUSgD2AWYlO

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks