Overview

overview

10

Static

static

10

e4ddc55ae7...fc.exe

windows7-x64

10

e4ddc55ae7...fc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4ddc55ae7aa7e087eadaa449eeed1a7de253565f7b2ef53c2e9bfec5d55dcfc.exe

  • Size

    1.4MB

  • Sample

    241123-n2lz2s1jbq

  • MD5

    0745161ebca7b94e13caca7a0f89b7fb

  • SHA1

    9dfb820c738616a08042081cda0c4dcbdbb4a970

  • SHA256

    e4ddc55ae7aa7e087eadaa449eeed1a7de253565f7b2ef53c2e9bfec5d55dcfc

  • SHA512

    d7bfe29f1e5a73c1dc8e31d148dd4e62265f5d7a3897061cba9d63bfa6541cab77aabfb17f89c090092f980f132a55f7eab5e6da99a2eece21afde3db02a67be

  • SSDEEP

    24576:z2G/nvxW3WwL+zdHJ2zljtfM8zCxqY3+SiSals+S5WhqN7+4H:zbA3f+hp4Zle+SIqNqo

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      e4ddc55ae7aa7e087eadaa449eeed1a7de253565f7b2ef53c2e9bfec5d55dcfc.exe

    • Size

      1.4MB

    • MD5

      0745161ebca7b94e13caca7a0f89b7fb

    • SHA1

      9dfb820c738616a08042081cda0c4dcbdbb4a970

    • SHA256

      e4ddc55ae7aa7e087eadaa449eeed1a7de253565f7b2ef53c2e9bfec5d55dcfc

    • SHA512

      d7bfe29f1e5a73c1dc8e31d148dd4e62265f5d7a3897061cba9d63bfa6541cab77aabfb17f89c090092f980f132a55f7eab5e6da99a2eece21afde3db02a67be

    • SSDEEP

      24576:z2G/nvxW3WwL+zdHJ2zljtfM8zCxqY3+SiSals+S5WhqN7+4H:zbA3f+hp4Zle+SIqNqo

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks