Overview

overview

10

Static

static

10

4f397836d4...48.exe

windows7-x64

10

4f397836d4...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f397836d46f499ed2e76b1d3df48a3327732dcc5c5f88b566add627932ad148.exe

  • Size

    1.2MB

  • Sample

    241123-yqxbrazmgp

  • MD5

    fd7254eaa1f74120831e100852a67077

  • SHA1

    03974b230e17665e275b1f684251456ab563b0d5

  • SHA256

    4f397836d46f499ed2e76b1d3df48a3327732dcc5c5f88b566add627932ad148

  • SHA512

    18d77b7853a7f2788fbe27b9ba6c1bdf529379ee0cdcce580db994ff7413ddce15464481224f1174e3769b6263d576d1da5ad88510a50399b646b23acbafc82a

  • SSDEEP

    24576:B2G/nvxW3W0nme0wCtsOkpS8BUvLlR5RevPxsJT2xdHM+4B:BbA3Huw/H08qRqvJsJTkHq

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      4f397836d46f499ed2e76b1d3df48a3327732dcc5c5f88b566add627932ad148.exe

    • Size

      1.2MB

    • MD5

      fd7254eaa1f74120831e100852a67077

    • SHA1

      03974b230e17665e275b1f684251456ab563b0d5

    • SHA256

      4f397836d46f499ed2e76b1d3df48a3327732dcc5c5f88b566add627932ad148

    • SHA512

      18d77b7853a7f2788fbe27b9ba6c1bdf529379ee0cdcce580db994ff7413ddce15464481224f1174e3769b6263d576d1da5ad88510a50399b646b23acbafc82a

    • SSDEEP

      24576:B2G/nvxW3W0nme0wCtsOkpS8BUvLlR5RevPxsJT2xdHM+4B:BbA3Huw/H08qRqvJsJTkHq

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks