Overview

overview

10

Static

static

10

f1c2810c41...fc.exe

windows7-x64

10

f1c2810c41...fc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1c2810c41b2ce2c8755377c3644d17762137d662ef4f03b7cddd3db992c60fc

  • Size

    2.3MB

  • Sample

    241108-gqg4dszjcn

  • MD5

    efeb65d7748ea77088bf95d64d01dab9

  • SHA1

    76204068586a564ed47909d98399f5b62dad8bc9

  • SHA256

    f1c2810c41b2ce2c8755377c3644d17762137d662ef4f03b7cddd3db992c60fc

  • SHA512

    016711a46294ff3d00ccaae375173aadc6f6e7e0ee0a20e696a76090849e135dbd57b07d3031239667e3d3e99050edc421e143bcbded64554948e4c73545ba4e

  • SSDEEP

    49152:NNAjgh7ll3AWyyks+zsfkRgpc/OCuYxziOHpXw8y7yuzGOni:/lh7ll3ATyks+QfMlJxziONuGii

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      f1c2810c41b2ce2c8755377c3644d17762137d662ef4f03b7cddd3db992c60fc

    • Size

      2.3MB

    • MD5

      efeb65d7748ea77088bf95d64d01dab9

    • SHA1

      76204068586a564ed47909d98399f5b62dad8bc9

    • SHA256

      f1c2810c41b2ce2c8755377c3644d17762137d662ef4f03b7cddd3db992c60fc

    • SHA512

      016711a46294ff3d00ccaae375173aadc6f6e7e0ee0a20e696a76090849e135dbd57b07d3031239667e3d3e99050edc421e143bcbded64554948e4c73545ba4e

    • SSDEEP

      49152:NNAjgh7ll3AWyyks+zsfkRgpc/OCuYxziOHpXw8y7yuzGOni:/lh7ll3ATyks+QfMlJxziONuGii

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks