Overview

overview

10

Static

static

3

51ED2A0701...48.exe

windows7-x64

10

51ED2A0701...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51ED2A0701D313F3761169D91FB69848.exe

  • Size

    2.4MB

  • Sample

    241102-t9y78ssnhj

  • MD5

    51ed2a0701d313f3761169d91fb69848

  • SHA1

    ed39a76db78d1d3c9c3a3a20d5dcf8da19e51ba3

  • SHA256

    1b304c8a2ae4546bd7958c7f22becaf6b682a5c88b7a01945a952de991b0ef0b

  • SHA512

    324bb255f7b5edef459ca8c5ec88509cd86f0fc060c546c9484294db5c97bcd56d0483b0074d63763f85fea0807ed2b3e10fb7749c797e0ea3d511382dd0be85

  • SSDEEP

    49152:3XfX30/e4wkPaOoMoa+QPPHPahen4S2V526is7K9gn6weB1din4OEU6zMa:nf0/e47aOoMcQP6M4S+4676P3wn4dz

Score
10/10
dcratdiscoveryevasioninfostealerrat

Malware Config

Targets

    • Target

      51ED2A0701D313F3761169D91FB69848.exe

    • Size

      2.4MB

    • MD5

      51ed2a0701d313f3761169d91fb69848

    • SHA1

      ed39a76db78d1d3c9c3a3a20d5dcf8da19e51ba3

    • SHA256

      1b304c8a2ae4546bd7958c7f22becaf6b682a5c88b7a01945a952de991b0ef0b

    • SHA512

      324bb255f7b5edef459ca8c5ec88509cd86f0fc060c546c9484294db5c97bcd56d0483b0074d63763f85fea0807ed2b3e10fb7749c797e0ea3d511382dd0be85

    • SSDEEP

      49152:3XfX30/e4wkPaOoMoa+QPPHPahen4S2V526is7K9gn6weB1din4OEU6zMa:nf0/e47aOoMcQP6M4S+4676P3wn4dz

    Score
    10/10
    dcratdiscoveryevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks