Overview

overview

10

Static

static

10

b1d4305605...15.exe

windows7-x64

10

b1d4305605...15.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515

  • Size

    827KB

  • Sample

    241105-qbppcstpgm

  • MD5

    7dd8afbb49ae5a087a23e98931557da2

  • SHA1

    925549dc8d4b1f21905d6430796b88c795648ed2

  • SHA256

    b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515

  • SHA512

    4e64d47e0c0b452546054a00491c60137ec9f4373554bda5a8e4099e803a9829e98bf130d2bec9cae9bc21eff41fc24487f50993e3316f2230c82eb08c5f9edb

  • SSDEEP

    12288:H9nfsdPp5UPYBf4HFrsulbCAx2Qg8UcYps8CNfhfG7Ik2Q:H9fjPYBCFrPlb59Us8CDfQIk2Q

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515

    • Size

      827KB

    • MD5

      7dd8afbb49ae5a087a23e98931557da2

    • SHA1

      925549dc8d4b1f21905d6430796b88c795648ed2

    • SHA256

      b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515

    • SHA512

      4e64d47e0c0b452546054a00491c60137ec9f4373554bda5a8e4099e803a9829e98bf130d2bec9cae9bc21eff41fc24487f50993e3316f2230c82eb08c5f9edb

    • SSDEEP

      12288:H9nfsdPp5UPYBf4HFrsulbCAx2Qg8UcYps8CNfhfG7Ik2Q:H9fjPYBCFrPlb59Us8CDfQIk2Q

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks