Overview

overview

10

Static

static

3

Verify_adv...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Verify_advanced_encrypted.exe.exe

  • Size

    25KB

  • Sample

    241128-vzqnsazmbj

  • MD5

    937c41f1b4d53bca113f2aaf35985939

  • SHA1

    422a01bf2701ac7c9f7dcbfc51b974544daadde3

  • SHA256

    7f3ab101faf2bdfa164b1884ede53aface5c1ae6c28f4464b9750f9d31c43fcd

  • SHA512

    9473795303b12419640783069bfe876d1dced371aedd632f8ff2f732acce06efa99df880e7aeaec29c20526f41b2193d671b9e0a2560d3503e66d9dccf78a8ac

  • SSDEEP

    384:NaBkyPgdGJ3Ja7PXGcgGjsxxX5Hs0JxlA/1yBmDpTOOze3jFaJGiK2nLi7joK3MC:JYgg0ULM0K9SOzMWGrGi7joK3v

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      Verify_advanced_encrypted.exe.exe

    • Size

      25KB

    • MD5

      937c41f1b4d53bca113f2aaf35985939

    • SHA1

      422a01bf2701ac7c9f7dcbfc51b974544daadde3

    • SHA256

      7f3ab101faf2bdfa164b1884ede53aface5c1ae6c28f4464b9750f9d31c43fcd

    • SHA512

      9473795303b12419640783069bfe876d1dced371aedd632f8ff2f732acce06efa99df880e7aeaec29c20526f41b2193d671b9e0a2560d3503e66d9dccf78a8ac

    • SSDEEP

      384:NaBkyPgdGJ3Ja7PXGcgGjsxxX5Hs0JxlA/1yBmDpTOOze3jFaJGiK2nLi7joK3MC:JYgg0ULM0K9SOzMWGrGi7joK3v

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies WinLogon

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks