dcrat | a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae | Triage

Sharing

General

Target

a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe
Size

10.1MB
Sample

241122-q9a9maxqak
MD5

2ee8eb2b3997b0cce6cc7c562a785719
SHA1

b2d31d2a30815fa0c6dd1e637d7276bfb0547411
SHA256

a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae
SHA512

34ee0171c041205b4b6bb631e0b72fb2f4d3056892281839f0b2e63b9f1997e037755cedd0d56dd64d96ddc878874148611f6eb4ee83238dd560ed59848e8059
SSDEEP

24576:W+O4GptFtiU9SsYm1oO9teGnlcZ/uIO0EdZX0usIW6fgtixy4s+8BIbT19h8OCht:x5o9Y+Iu0u+YoAgO9kK4XyWDAyH6eB

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Targets

- Target
  
  a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe
- Size
  
  10.1MB
- MD5
  
  2ee8eb2b3997b0cce6cc7c562a785719
- SHA1
  
  b2d31d2a30815fa0c6dd1e637d7276bfb0547411
- SHA256
  
  a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae
- SHA512
  
  34ee0171c041205b4b6bb631e0b72fb2f4d3056892281839f0b2e63b9f1997e037755cedd0d56dd64d96ddc878874148611f6eb4ee83238dd560ed59848e8059
- SSDEEP
  
  24576:W+O4GptFtiU9SsYm1oO9teGnlcZ/uIO0EdZX0usIW6fgtixy4s+8BIbT19h8OCht:x5o9Y+Iu0u+YoAgO9kK4XyWDAyH6eB
Score

10^/10

dcrat infostealer persistence rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratinfostealerpersistencerat

behavioral2

dcratinfostealerpersistencerat