Overview

overview

10

Static

static

3

usermode.exe

windows7-x64

6

usermode.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    usermode.exe

  • Size

    671KB

  • Sample

    241205-w1nq9awmay

  • MD5

    0f1700ee21d3f50876ba87ba59b5362c

  • SHA1

    0204c433d0529811f23b71582da12e4276b3439f

  • SHA256

    92c13c55b6e2afc22881d1bd9cbea837d7f2dbc3e1c17c194608f2f86d0cc597

  • SHA512

    6ac8306aebf8161019df51b26078f3c993aeda3ecb9d4510e67fe788555d91a8453943136568bc643643b9fdea2983771fe35eecff47cafcc577aec789ef1f89

  • SSDEEP

    12288:RZco5avwoS8/jtVoMpaSU5WflFr5//EmnBPG2pptCA:WFS8/eS4WflFr5//EmnVrbt

Score
10/10
dcratdefense_evasiondiscoveryinfostealerrat

Malware Config

Targets

    • Target

      usermode.exe

    • Size

      671KB

    • MD5

      0f1700ee21d3f50876ba87ba59b5362c

    • SHA1

      0204c433d0529811f23b71582da12e4276b3439f

    • SHA256

      92c13c55b6e2afc22881d1bd9cbea837d7f2dbc3e1c17c194608f2f86d0cc597

    • SHA512

      6ac8306aebf8161019df51b26078f3c993aeda3ecb9d4510e67fe788555d91a8453943136568bc643643b9fdea2983771fe35eecff47cafcc577aec789ef1f89

    • SSDEEP

      12288:RZco5avwoS8/jtVoMpaSU5WflFr5//EmnBPG2pptCA:WFS8/eS4WflFr5//EmnVrbt

    Score
    10/10
    defense_evasiondcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks