Overview

overview

10

Static

static

10

c1f933dff9...2c.exe

windows7-x64

10

c1f933dff9...2c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1f933dff9c16bc5dce053584b2112183b119f86de63e755fedab81d26d8d42c.exe

  • Size

    1.1MB

  • Sample

    241126-vel5vszmew

  • MD5

    47ca2bfa2766ff45af97abbd85cd2e6d

  • SHA1

    248680da6aad01e8416e19ed8666ba5462de3bd3

  • SHA256

    c1f933dff9c16bc5dce053584b2112183b119f86de63e755fedab81d26d8d42c

  • SHA512

    60c2f234538bc55b739f7f8131ef1efe00a77cc42c5647e93c93b9408c89c1c9c20b7bfccd01e9aa84a39bb2e7c096c8b89fdf415c402b74927b7320902c44de

  • SSDEEP

    24576:AMYPCI+q+U4cIG409ozWucypk1Nd4AX+iB/YjuM6kyh+W:ABPZ0Kr1FXHB/guM6k+f

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      c1f933dff9c16bc5dce053584b2112183b119f86de63e755fedab81d26d8d42c.exe

    • Size

      1.1MB

    • MD5

      47ca2bfa2766ff45af97abbd85cd2e6d

    • SHA1

      248680da6aad01e8416e19ed8666ba5462de3bd3

    • SHA256

      c1f933dff9c16bc5dce053584b2112183b119f86de63e755fedab81d26d8d42c

    • SHA512

      60c2f234538bc55b739f7f8131ef1efe00a77cc42c5647e93c93b9408c89c1c9c20b7bfccd01e9aa84a39bb2e7c096c8b89fdf415c402b74927b7320902c44de

    • SSDEEP

      24576:AMYPCI+q+U4cIG409ozWucypk1Nd4AX+iB/YjuM6kyh+W:ABPZ0Kr1FXHB/guM6k+f

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks