Overview

overview

10

Static

static

10

test.exe

windows10-2004-x64

test.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test.exe

  • Size

    1.1MB

  • Sample

    241105-z1vfksydjg

  • MD5

    4a00e42d19f9bae651f70e79cd5ef162

  • SHA1

    b196db8fc96765b65f9da36f7c55664e9c756bb9

  • SHA256

    de577ab25710e06a94efa8f9b0b2f425377cb8df68c5068ce65204ee5b28a067

  • SHA512

    69735af42d4d44ff7814beacee6a0b80a841f44f09962a5d42ab9fdac673971fcd10e76de53b25ce19693fe6826e557fc8fe4721b3611ac22efbfa76f7405055

  • SSDEEP

    24576:u2G/nvxW3WieCs/p/1uLbrQZVK8qBlKSUd:ubA3j7TQL3Ane

Score
10/10
dcratcredential_accessdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      test.exe

    • Size

      1.1MB

    • MD5

      4a00e42d19f9bae651f70e79cd5ef162

    • SHA1

      b196db8fc96765b65f9da36f7c55664e9c756bb9

    • SHA256

      de577ab25710e06a94efa8f9b0b2f425377cb8df68c5068ce65204ee5b28a067

    • SHA512

      69735af42d4d44ff7814beacee6a0b80a841f44f09962a5d42ab9fdac673971fcd10e76de53b25ce19693fe6826e557fc8fe4721b3611ac22efbfa76f7405055

    • SSDEEP

      24576:u2G/nvxW3WieCs/p/1uLbrQZVK8qBlKSUd:ubA3j7TQL3Ane

    Score
    10/10
    dcratdiscoveryinfostealerratcredential_accessspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks