dcrat | 545ec0cff0698c5502aa7a7727d67c8de1546f2435f94e4a845d4d65dbfb1008 | Triage

Sharing

General

Target

545ec0cff0698c5502aa7a7727d67c8de1546f2435f94e4a845d4d65dbfb1008N
Size

1.8MB
Sample

241031-dswssayerl
MD5

cdfe4113f2d0e3d04921aaf02a61f4c0
SHA1

f6677353b59a891a2fe06dc2971ec383154c3094
SHA256

545ec0cff0698c5502aa7a7727d67c8de1546f2435f94e4a845d4d65dbfb1008
SHA512

6892293e3a3856fd10161970e1ff149ea320bc6fc1e57c7d636d7dde25b82a9715344a5638f5d55ed4b0224cbe7af2fc8a55e6367ad3f1d5272104c7777f5404
SSDEEP

24576:opSTNuxSGxU+s8DpWgdOK5QX/aJfaOtdnDc0GcWiJHMTJd6dFdoQQDymYPj9rnWC:o/Uo5QigOMPy2TzyF2Qj9WJ

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Targets

- Target
  
  545ec0cff0698c5502aa7a7727d67c8de1546f2435f94e4a845d4d65dbfb1008N
- Size
  
  1.8MB
- MD5
  
  cdfe4113f2d0e3d04921aaf02a61f4c0
- SHA1
  
  f6677353b59a891a2fe06dc2971ec383154c3094
- SHA256
  
  545ec0cff0698c5502aa7a7727d67c8de1546f2435f94e4a845d4d65dbfb1008
- SHA512
  
  6892293e3a3856fd10161970e1ff149ea320bc6fc1e57c7d636d7dde25b82a9715344a5638f5d55ed4b0224cbe7af2fc8a55e6367ad3f1d5272104c7777f5404
- SSDEEP
  
  24576:opSTNuxSGxU+s8DpWgdOK5QX/aJfaOtdnDc0GcWiJHMTJd6dFdoQQDymYPj9rnWC:o/Uo5QigOMPy2TzyF2Qj9WJ
Score

10^/10

dcrat discovery infostealer persistence rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratdiscoveryinfostealerpersistencerat

behavioral2

dcratinfostealerpersistencerat