Overview

overview

10

Static

static

3

d10f5b84ae...5N.exe

windows7-x64

10

d10f5b84ae...5N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d10f5b84ae114c7ad063b9e8397da1aad8074cee7d9bcac500a353459daf7ab5N.exe

  • Size

    1.8MB

  • Sample

    241119-qd8v1s1mfr

  • MD5

    0f6832bc8381b05096f8ffac1272e400

  • SHA1

    be7722fb36f12432f6da2e051d1f96761e97fcf4

  • SHA256

    d10f5b84ae114c7ad063b9e8397da1aad8074cee7d9bcac500a353459daf7ab5

  • SHA512

    7fabcaac732873a97990faba9a06fee2b4c4febf8e5be1b223827c10671151854dcd755ca492c5738bebb18dd0dc3616a2e08768ae69d80bd681259008d04548

  • SSDEEP

    24576:zyvTg4STbYSG65XZsTBsR36Y1864kHFLlb/sgaspAqsbTsIvVJUl52iFxA4Gbg:W6hdR3KlyFLlbsrs6PbTJU24Gb

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      d10f5b84ae114c7ad063b9e8397da1aad8074cee7d9bcac500a353459daf7ab5N.exe

    • Size

      1.8MB

    • MD5

      0f6832bc8381b05096f8ffac1272e400

    • SHA1

      be7722fb36f12432f6da2e051d1f96761e97fcf4

    • SHA256

      d10f5b84ae114c7ad063b9e8397da1aad8074cee7d9bcac500a353459daf7ab5

    • SHA512

      7fabcaac732873a97990faba9a06fee2b4c4febf8e5be1b223827c10671151854dcd755ca492c5738bebb18dd0dc3616a2e08768ae69d80bd681259008d04548

    • SSDEEP

      24576:zyvTg4STbYSG65XZsTBsR36Y1864kHFLlb/sgaspAqsbTsIvVJUl52iFxA4Gbg:W6hdR3KlyFLlbsrs6PbTJU24Gb

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks