dcrat

General

Target

Solara NEW.exe
Size

6.9MB
Sample

241020-tjpwwayflm
MD5

23afefaf5360cd0ece4cb0d5f9f59088
SHA1

09464062917ac2af3bcd8d8d669a9b324b2c88db
SHA256

0d1f2e73c09d687276067a433262e1f8dc6a1e2ac64d06bd1f6f9c6f2d559247
SHA512

de4b9b161935b118493cbb8c1bdaf77bdd83de9f2993f5000462ee367ed6a260b3bedee033278a1f0db85535ee1df112ee26d11c8b45f9fc1c2e6d5c64ba2357
SSDEEP

98304:frWORYn3zDs9FD9Br8/ja/9PdnFBVXnnG0+zHVRgMmVzuIMlHK04PBgTKZ9r/hak:qPDivr8uRVZnAH/xmVzdMleuTQpwEqvE

Score

10^/10

Malware Config

Targets

- Target
  
  Solara NEW.exe
- Size
  
  6.9MB
- MD5
  
  23afefaf5360cd0ece4cb0d5f9f59088
- SHA1
  
  09464062917ac2af3bcd8d8d669a9b324b2c88db
- SHA256
  
  0d1f2e73c09d687276067a433262e1f8dc6a1e2ac64d06bd1f6f9c6f2d559247
- SHA512
  
  de4b9b161935b118493cbb8c1bdaf77bdd83de9f2993f5000462ee367ed6a260b3bedee033278a1f0db85535ee1df112ee26d11c8b45f9fc1c2e6d5c64ba2357
- SSDEEP
  
  98304:frWORYn3zDs9FD9Br8/ja/9PdnFBVXnnG0+zHVRgMmVzuIMlHK04PBgTKZ9r/hak:qPDivr8uRVZnAH/xmVzdMleuTQpwEqvE
Score

10^/10

dcrat discovery evasion execution infostealer persistence rat spyware stealer
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1