Overview

overview

10

Static

static

10

4c66508139...09.exe

windows7-x64

10

4c66508139...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe

  • Size

    1.9MB

  • Sample

    241111-ctw99stnan

  • MD5

    4cc23344d26c44260cb52028cff992b7

  • SHA1

    7f2b7a02ae3f65c6757f134a79c302a92e31311c

  • SHA256

    4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609

  • SHA512

    71e7ced9568ede15e9a9fe6edbd7ed77559f9046e8fc77ce83bb3fd464c61794ba719451774b2c02f30abc80a51f3563a1491a74d7f390d8152cd0b3b2928c45

  • SSDEEP

    49152:UbA30IKxSrOw6FNapB0LFyYsyqX96ZU8jMWg3:UberOGpaMYducjM3

Score
10/10
dcratdiscoveryevasioninfostealerrattrojan

Malware Config

Targets

    • Target

      4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe

    • Size

      1.9MB

    • MD5

      4cc23344d26c44260cb52028cff992b7

    • SHA1

      7f2b7a02ae3f65c6757f134a79c302a92e31311c

    • SHA256

      4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609

    • SHA512

      71e7ced9568ede15e9a9fe6edbd7ed77559f9046e8fc77ce83bb3fd464c61794ba719451774b2c02f30abc80a51f3563a1491a74d7f390d8152cd0b3b2928c45

    • SSDEEP

      49152:UbA30IKxSrOw6FNapB0LFyYsyqX96ZU8jMWg3:UberOGpaMYducjM3

    Score
    10/10
    dcratdiscoveryevasioninfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks