dcrat | b02038aa2ee3194542d8e062aedcbb66015051ae31d5c0ec6a68dd7a26ef6205 | Triage

Submit
Reports

Overview

overview

Static

static

3

b02038aa2e...05.exe

windows7-x64

b02038aa2e...05.exe

windows10-2004-x64

Sharing

General

Target

b02038aa2ee3194542d8e062aedcbb66015051ae31d5c0ec6a68dd7a26ef6205
Size

4.2MB
Sample

241128-wnggea1kbn
MD5

2608e3e0677de70d9e1eb6b108f7bdfd
SHA1

c7d42a6abb29fcbde1cdc13f681d449ced6b8a50
SHA256

b02038aa2ee3194542d8e062aedcbb66015051ae31d5c0ec6a68dd7a26ef6205
SHA512

e1664a02f3e0b101ada2ef5af8fdebc4b75aecc795c1fa04cab36e7b478c11516d8daba1f65159ad7d8c2b9680dd771fac5ba24218b861807851042f1ba82c9d
SSDEEP

49152:2chlG/HMHyN4pAEx/7dvDhzETOIntW9y3yP2QAuxQzxEzwYjiwVTkO2kZBtk8hJq:

Score

10^/10

dcrat discovery infostealer rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b02038aa2ee3194542d8e062aedcbb66015051ae31d5c0ec6a68dd7a26ef6205.exe

Resource

win7-20240903-en

dcrat discovery infostealer rat

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

b02038aa2ee3194542d8e062aedcbb66015051ae31d5c0ec6a68dd7a26ef6205.exe

Resource

win10v2004-20241007-en

dcrat discovery infostealer rat

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  b02038aa2ee3194542d8e062aedcbb66015051ae31d5c0ec6a68dd7a26ef6205
- Size
  
  4.2MB
- MD5
  
  2608e3e0677de70d9e1eb6b108f7bdfd
- SHA1
  
  c7d42a6abb29fcbde1cdc13f681d449ced6b8a50
- SHA256
  
  b02038aa2ee3194542d8e062aedcbb66015051ae31d5c0ec6a68dd7a26ef6205
- SHA512
  
  e1664a02f3e0b101ada2ef5af8fdebc4b75aecc795c1fa04cab36e7b478c11516d8daba1f65159ad7d8c2b9680dd771fac5ba24218b861807851042f1ba82c9d
- SSDEEP
  
  49152:2chlG/HMHyN4pAEx/7dvDhzETOIntW9y3yP2QAuxQzxEzwYjiwVTkO2kZBtk8hJq:
Score

10^/10

dcrat discovery infostealer rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratdiscoveryinfostealerrat

behavioral2

dcratdiscoveryinfostealerrat

© 2018-2024

Terms | Privacy