Overview

overview

10

Static

static

10

cwel.zip

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cwel.zip

  • Size

    11.1MB

  • Sample

    241220-p2pllswmey

  • MD5

    2a9f3aa47c3089ab25f5755b659def4c

  • SHA1

    31fec6624ab4ed412aad69fcaaa9e7ccef06abb9

  • SHA256

    794c1b48e399a4ac173dcb4a6a619ad53cfa99f52b9685dc62d922dd879acb29

  • SHA512

    0483b54ed252b5499aedf395f692a4ce884f15399b883499d66304ffa06564df8fd5bbfd48c6e52905f6d2fb3f686dcf4b0add1314181f0b80601c1f2e66558c

  • SSDEEP

    196608:dPvlJIITPqNr34qtBFN2OtLI2YAKIcQKf7QVQKWXdk5SkqBkEZLT7oNulGOtsDvR:1vwIeNroqn82YAjcQsQvWXdk4kqBkEZA

Score
10/10
dcratdiscoveryevasioninfostealerrat

Malware Config

Targets

    • Target

      cwel.zip

    • Size

      11.1MB

    • MD5

      2a9f3aa47c3089ab25f5755b659def4c

    • SHA1

      31fec6624ab4ed412aad69fcaaa9e7ccef06abb9

    • SHA256

      794c1b48e399a4ac173dcb4a6a619ad53cfa99f52b9685dc62d922dd879acb29

    • SHA512

      0483b54ed252b5499aedf395f692a4ce884f15399b883499d66304ffa06564df8fd5bbfd48c6e52905f6d2fb3f686dcf4b0add1314181f0b80601c1f2e66558c

    • SSDEEP

      196608:dPvlJIITPqNr34qtBFN2OtLI2YAKIcQKf7QVQKWXdk5SkqBkEZLT7oNulGOtsDvR:1vwIeNroqn82YAjcQsQvWXdk4kqBkEZA

    Score
    10/10
    dcratdiscoveryevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks