dcrat | c53519ff0006a7b1a806fb8cac04e13fb6afa8ef4555a5e3079ac2b200d112af | Triage

Sharing

General

Target

c53519ff0006a7b1a806fb8cac04e13fb6afa8ef4555a5e3079ac2b200d112af.exe
Size

8.4MB
Sample

241121-eqel6ayme1
MD5

23e7c44b93cb1b729d816de6e2800888
SHA1

aa0d6d3655991fcc2bee30f2e4002150c3c08c7f
SHA256

c53519ff0006a7b1a806fb8cac04e13fb6afa8ef4555a5e3079ac2b200d112af
SHA512

78671a96f54348695f839199340cd4fa5f9816c0ab740c8492f877deba6bed3191407e3096f3bd107cde7e65cd12a15140222656c2f53f8d7ece6881ec456fb9
SSDEEP

24576:L+O4Gq8ijgGfy8vWYT0Z3VTaLMo6e7h4su+A3uFDIU2lklx2yDUZFyn7ftR0K1ww:6hJgGfys0DTi7hhcGWn1ZBfY4KGrM

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Targets

- Target
  
  c53519ff0006a7b1a806fb8cac04e13fb6afa8ef4555a5e3079ac2b200d112af.exe
- Size
  
  8.4MB
- MD5
  
  23e7c44b93cb1b729d816de6e2800888
- SHA1
  
  aa0d6d3655991fcc2bee30f2e4002150c3c08c7f
- SHA256
  
  c53519ff0006a7b1a806fb8cac04e13fb6afa8ef4555a5e3079ac2b200d112af
- SHA512
  
  78671a96f54348695f839199340cd4fa5f9816c0ab740c8492f877deba6bed3191407e3096f3bd107cde7e65cd12a15140222656c2f53f8d7ece6881ec456fb9
- SSDEEP
  
  24576:L+O4Gq8ijgGfy8vWYT0Z3VTaLMo6e7h4su+A3uFDIU2lklx2yDUZFyn7ftR0K1ww:6hJgGfys0DTi7hhcGWn1ZBfY4KGrM
Score

10^/10

dcrat infostealer persistence rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratinfostealerpersistencerat

behavioral2

dcratinfostealerpersistencerat