dcrat | 4139522809118bba10441242323550ef8f00264e862a5403dab48c1c5c8ad654 | Triage

Submit
Reports

Overview

overview

Static

static

4139522809...54.exe

windows7-x64

4139522809...54.exe

windows10-2004-x64

Sharing

General

Target

4139522809118bba10441242323550ef8f00264e862a5403dab48c1c5c8ad654.exe
Size

1.9MB
Sample

241027-crjw6azrav
MD5

f462fd11ceda48487db07c5b70410dac
SHA1

48010b409ab20a6a51e562d347b87abcb15dd9fe
SHA256

4139522809118bba10441242323550ef8f00264e862a5403dab48c1c5c8ad654
SHA512

7ba4a2fae1b0558b4a2d1a081a9f63cc0b4184a395fe58a31083bf1e6b4e597938d0ecda8d0e45d03e26a848c1ad30c75941ade6e49f4237bb70139127c72204
SSDEEP

24576:h2G/nvxW3WCG0xfX0iy3dwFTQ40aI2GP1NE4utdShDpIBUx9PWRW/+YK8bnCAtF:hbA3rnxf0iyoTQi1a1wtStlx9sYX

Score

10^/10

dcrat discovery evasion infostealer rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

4139522809118bba10441242323550ef8f00264e862a5403dab48c1c5c8ad654.exe

Resource

win7-20240903-en

dcrat discovery evasion infostealer rat

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

4139522809118bba10441242323550ef8f00264e862a5403dab48c1c5c8ad654.exe

Resource

win10v2004-20241007-en

dcrat discovery evasion infostealer rat

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  4139522809118bba10441242323550ef8f00264e862a5403dab48c1c5c8ad654.exe
- Size
  
  1.9MB
- MD5
  
  f462fd11ceda48487db07c5b70410dac
- SHA1
  
  48010b409ab20a6a51e562d347b87abcb15dd9fe
- SHA256
  
  4139522809118bba10441242323550ef8f00264e862a5403dab48c1c5c8ad654
- SHA512
  
  7ba4a2fae1b0558b4a2d1a081a9f63cc0b4184a395fe58a31083bf1e6b4e597938d0ecda8d0e45d03e26a848c1ad30c75941ade6e49f4237bb70139127c72204
- SSDEEP
  
  24576:h2G/nvxW3WCG0xfX0iy3dwFTQ40aI2GP1NE4utdShDpIBUx9PWRW/+YK8bnCAtF:hbA3rnxf0iyoTQi1a1wtStlx9sYX
Score

10^/10

dcrat discovery evasion infostealer rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratdiscoveryevasioninfostealerrat

behavioral2

dcratdiscoveryevasioninfostealerrat

© 2018-2024

Terms | Privacy