Overview

overview

10

Static

static

10

4003b5df58...23.exe

windows7-x64

10

4003b5df58...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe

  • Size

    924KB

  • Sample

    241123-p3laks1nhm

  • MD5

    e44a6dd4f61c4c3138fc1c81f13ce0a9

  • SHA1

    a8479aee1b3e22cd059cf38b3110d69a5504102b

  • SHA256

    4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323

  • SHA512

    ec423fe26d7e9a7a726bbbfe2d7dd7c0235c6bc3111e795d0d99b4ee76b453d1e548bd943e29ee7d607a7f39ed8f78f20ae5885d77f8e6db35607806616b3219

  • SSDEEP

    12288:aRZ+IoG/n9IQxW3OBsee2X+t4RboqnOH0qhDD2hBM5biqZUAu09SwRRpfcg:U2G/nvxW3Ww0to+OHt7iefRpft

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe

    • Size

      924KB

    • MD5

      e44a6dd4f61c4c3138fc1c81f13ce0a9

    • SHA1

      a8479aee1b3e22cd059cf38b3110d69a5504102b

    • SHA256

      4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323

    • SHA512

      ec423fe26d7e9a7a726bbbfe2d7dd7c0235c6bc3111e795d0d99b4ee76b453d1e548bd943e29ee7d607a7f39ed8f78f20ae5885d77f8e6db35607806616b3219

    • SSDEEP

      12288:aRZ+IoG/n9IQxW3OBsee2X+t4RboqnOH0qhDD2hBM5biqZUAu09SwRRpfcg:U2G/nvxW3Ww0to+OHt7iefRpft

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks