Overview

overview

10

Static

static

10

d9bfa2b5b0...75.exe

windows7-x64

10

d9bfa2b5b0...75.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9bfa2b5b08b1708ce9083cd1ce174e5f38fc7e92e17aa2148a5b1a388b27f75.exe

  • Size

    1.5MB

  • Sample

    241121-bn94hayann

  • MD5

    bdf8dba699d63caad5ea9a29a0f6dfda

  • SHA1

    60b104b39c4b843e982fba55dc94ca89c444a315

  • SHA256

    d9bfa2b5b08b1708ce9083cd1ce174e5f38fc7e92e17aa2148a5b1a388b27f75

  • SHA512

    d2200cbbe4312dc5f0c57d45306ac1dd988f8b4892b036ca2b7f05bf0d75f213303b7d4e20a0e0b39862c0d59966468458ba37db084e1972b58b8a6ebce3fa6a

  • SSDEEP

    24576:Q2G/nvxW3W8ARZJJJJjsJJJJvJHJJJJJJ/wYnWW5Yxwo06RF91aOd9lfLQP9gMsD:QbA34VAb5J8RFyA10DsGxpQ

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      d9bfa2b5b08b1708ce9083cd1ce174e5f38fc7e92e17aa2148a5b1a388b27f75.exe

    • Size

      1.5MB

    • MD5

      bdf8dba699d63caad5ea9a29a0f6dfda

    • SHA1

      60b104b39c4b843e982fba55dc94ca89c444a315

    • SHA256

      d9bfa2b5b08b1708ce9083cd1ce174e5f38fc7e92e17aa2148a5b1a388b27f75

    • SHA512

      d2200cbbe4312dc5f0c57d45306ac1dd988f8b4892b036ca2b7f05bf0d75f213303b7d4e20a0e0b39862c0d59966468458ba37db084e1972b58b8a6ebce3fa6a

    • SSDEEP

      24576:Q2G/nvxW3W8ARZJJJJjsJJJJvJHJJJJJJ/wYnWW5Yxwo06RF91aOd9lfLQP9gMsD:QbA34VAb5J8RFyA10DsGxpQ

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks