Overview

overview

10

Static

static

10

blum.exe

windows7-x64

10

blum.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    blum.exe

  • Size

    1.1MB

  • Sample

    241129-s9x5hatnbv

  • MD5

    a1d4782417480660db2ba6a327755b76

  • SHA1

    ec3e6ab4b58ba02e47a187dbfa404a187140b3a3

  • SHA256

    b92b26104f6813dbaccc15c7595e2cfb3f25a4206aa1b7957bbeac03d5958ef8

  • SHA512

    50812782ea2fb0a5de109f6e9e5b64a8c6b2ff1102f573f63e75f42274075ab4c8999cf0a62d8ea7f73ee190fbedc2881380d77c4b56de2cd1f029939822461d

  • SSDEEP

    24576:U2G/nvxW3Ww0tqoBuQ+I5p5qpLhu33BWwXqto:UbA30TYQ+8qpNWRDq2

Score
10/10
dcratdiscoveryevasioninfostealerrat

Malware Config

Targets

    • Target

      blum.exe

    • Size

      1.1MB

    • MD5

      a1d4782417480660db2ba6a327755b76

    • SHA1

      ec3e6ab4b58ba02e47a187dbfa404a187140b3a3

    • SHA256

      b92b26104f6813dbaccc15c7595e2cfb3f25a4206aa1b7957bbeac03d5958ef8

    • SHA512

      50812782ea2fb0a5de109f6e9e5b64a8c6b2ff1102f573f63e75f42274075ab4c8999cf0a62d8ea7f73ee190fbedc2881380d77c4b56de2cd1f029939822461d

    • SSDEEP

      24576:U2G/nvxW3Ww0tqoBuQ+I5p5qpLhu33BWwXqto:UbA30TYQ+8qpNWRDq2

    Score
    10/10
    dcratdiscoveryevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks