Overview

overview

10

Static

static

10

b92b26104f...f8.exe

windows7-x64

10

b92b26104f...f8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1d4782417480660db2ba6a327755b76.bin

  • Size

    595KB

  • Sample

    241201-bx6gnswrgk

  • MD5

    5ed1c0ffad8d5ac0b693e9c4dfe1199a

  • SHA1

    35d2fc0e58a169aae92ce0eb71c82f6df436df7d

  • SHA256

    00f28547cae0aeaa60d23e5440f849687d7c7a21e9410b86717d3a9f19f8b0f9

  • SHA512

    d4841227780e080a15710b3c80b74f18d614bb63c52cff56704dfb2919b31479adc3ada1278218d04bfa87861c7b815c3cfe47df32d8278e831bb2f30295ec4e

  • SSDEEP

    12288:VW9i/bfDKRppMvqZ6TpEhRFyhGhxyC2gVF/csOtU:VW9srD8pMSZRFyUhxyCBFcBa

Score
10/10
dcratdiscoveryevasioninfostealerrat

Malware Config

Targets

    • Target

      b92b26104f6813dbaccc15c7595e2cfb3f25a4206aa1b7957bbeac03d5958ef8.exe

    • Size

      1.1MB

    • MD5

      a1d4782417480660db2ba6a327755b76

    • SHA1

      ec3e6ab4b58ba02e47a187dbfa404a187140b3a3

    • SHA256

      b92b26104f6813dbaccc15c7595e2cfb3f25a4206aa1b7957bbeac03d5958ef8

    • SHA512

      50812782ea2fb0a5de109f6e9e5b64a8c6b2ff1102f573f63e75f42274075ab4c8999cf0a62d8ea7f73ee190fbedc2881380d77c4b56de2cd1f029939822461d

    • SSDEEP

      24576:U2G/nvxW3Ww0tqoBuQ+I5p5qpLhu33BWwXqto:UbA30TYQ+8qpNWRDq2

    Score
    10/10
    dcratdiscoveryevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks