Overview

overview

10

Static

static

10

fa78ac8f4c...d4.exe

windows7-x64

10

fa78ac8f4c...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe

  • Size

    2.3MB

  • Sample

    241202-dp4zzssjgl

  • MD5

    4e69fcf73418a08fcb8b3e7e2ecb43c4

  • SHA1

    a3ecd09f65ca4e7821a0b7f8596edcd679573f5b

  • SHA256

    fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4

  • SHA512

    a6d1a2b6363ad8a560567e6c11a48f8d1bc4cdfc36474902edf39f676440be82619aae52279121a776486d0edfe7a448f0fe9707b27ae760c1d6dd0201f6adc3

  • SSDEEP

    49152:BwpUwcTZ0rUinysyVZl5LCCcG3RTXM34FIIPWYJxuQfUgtFneJ8BG5U:Bw1ctUyjTLC8puaX/neJ8BgU

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe

    • Size

      2.3MB

    • MD5

      4e69fcf73418a08fcb8b3e7e2ecb43c4

    • SHA1

      a3ecd09f65ca4e7821a0b7f8596edcd679573f5b

    • SHA256

      fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4

    • SHA512

      a6d1a2b6363ad8a560567e6c11a48f8d1bc4cdfc36474902edf39f676440be82619aae52279121a776486d0edfe7a448f0fe9707b27ae760c1d6dd0201f6adc3

    • SSDEEP

      49152:BwpUwcTZ0rUinysyVZl5LCCcG3RTXM34FIIPWYJxuQfUgtFneJ8BG5U:Bw1ctUyjTLC8puaX/neJ8BgU

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks