Overview

overview

10

Static

static

3

ParadisePrivate.exe

windows7-x64

6

ParadisePrivate.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ParadisePrivate.exe

  • Size

    855KB

  • Sample

    241210-nmtfksyrfj

  • MD5

    df367e723dc5759cdad30841910cd6af

  • SHA1

    eb6105e8f2462746108e94543e684c8d6a587dbb

  • SHA256

    a29663d874e5fba50215d6966591407d6c9d264371ec0e726bdf5a902cf11156

  • SHA512

    21f29b03a607ba8e3910ed27e802cf61db82dda0c1f3e9772127509dfd9eb7e81778463f47cbe4727116792eed83e11b91dc7fb72e455eb3b621201f9853dbb0

  • SSDEEP

    12288:KvGAa5J2tubG6rOH7Fso6veRSN2ff+zOe9egX7AlGXynGnIr9BqiXb1FP:KvGAMAubGeo60OegX7AoXyn6m7Vj

Score
10/10
dcratdefense_evasiondiscoveryinfostealerrat

Malware Config

Targets

    • Target

      ParadisePrivate.exe

    • Size

      855KB

    • MD5

      df367e723dc5759cdad30841910cd6af

    • SHA1

      eb6105e8f2462746108e94543e684c8d6a587dbb

    • SHA256

      a29663d874e5fba50215d6966591407d6c9d264371ec0e726bdf5a902cf11156

    • SHA512

      21f29b03a607ba8e3910ed27e802cf61db82dda0c1f3e9772127509dfd9eb7e81778463f47cbe4727116792eed83e11b91dc7fb72e455eb3b621201f9853dbb0

    • SSDEEP

      12288:KvGAa5J2tubG6rOH7Fso6veRSN2ff+zOe9egX7AlGXynGnIr9BqiXb1FP:KvGAMAubGeo60OegX7AoXyn6m7Vj

    Score
    10/10
    defense_evasiondcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks