Overview

overview

10

Static

static

3

74f1fcf96c...07.exe

windows7-x64

3

74f1fcf96c...07.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74f1fcf96c9e31f50f6d83072ec68d07.exe

  • Size

    19KB

  • Sample

    241214-3by91sxlfv

  • MD5

    74f1fcf96c9e31f50f6d83072ec68d07

  • SHA1

    f05ada88e038fef51b6f0840084cd0f155faaa0e

  • SHA256

    4944035addbf7b1db7cf58fca9cda3050fbf87c3b5ca18dc124ceae5767a8bea

  • SHA512

    2816798078e430930c77c7d992924a07159dea089d1462bc17833b197545af5eebbaecca23869b1b880128bf82c4a0ab815c490c7a08ca6ed7e48099ef479074

  • SSDEEP

    384:uJMu1ZUZebwYr/lfbX6b+f9daNutwoLmdKkd/rwmW:E11Zzb1bQ+fXaNOST/rU

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      74f1fcf96c9e31f50f6d83072ec68d07.exe

    • Size

      19KB

    • MD5

      74f1fcf96c9e31f50f6d83072ec68d07

    • SHA1

      f05ada88e038fef51b6f0840084cd0f155faaa0e

    • SHA256

      4944035addbf7b1db7cf58fca9cda3050fbf87c3b5ca18dc124ceae5767a8bea

    • SHA512

      2816798078e430930c77c7d992924a07159dea089d1462bc17833b197545af5eebbaecca23869b1b880128bf82c4a0ab815c490c7a08ca6ed7e48099ef479074

    • SSDEEP

      384:uJMu1ZUZebwYr/lfbX6b+f9daNutwoLmdKkd/rwmW:E11Zzb1bQ+fXaNOST/rU

    Score
    10/10
    discoverydcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks