General
- Target DCRatBuild.exe
- Size 1.1MB
- Sample241116-ml8y7sylen
- SHA256 d9cbcae95ae824014b6d2fd6d3269b00b09ab84ed44b45b21c0b1842e7cdc132
Score
10/10
Malware Config
Targets
-
- Target DCRatBuild.exe
- Size 1.1MB
- SHA256 d9cbcae95ae824014b6d2fd6d3269b00b09ab84ed44b45b21c0b1842e7cdc132
Score10/10DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Dcrat family
Modifies WinLogon for persistence
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
Executes dropped EXE
Adds Run key to start application
Drops file in System32 directory
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1