dcrat | fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4 | Triage

Sharing

General

Target

fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4
Size

2.0MB
Sample

241221-hr8heavrcs
MD5

ff6e26dc9893c97196aefe245defeff9
SHA1

6ec3649790e948299b43bc522ee6d3fc9d10f769
SHA256

fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4
SHA512

6c4f76b35b0a90ca8e132d20a3b9d0eaf4752c6c49efe9a6f180b3b7a2091af55f8cab0be881e499a90da496ccbce7550eba4d8a3bc124060b429d44fb08e0a0
SSDEEP

49152:1Djlabwz9WV429A3twp/pZ5zUg45hGUrf/osAX4RUhpKT/+qYiv:Zqw+T9ewpRzz6OUkR4R7TmqYK

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Targets

- Target
  
  fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4
- Size
  
  2.0MB
- MD5
  
  ff6e26dc9893c97196aefe245defeff9
- SHA1
  
  6ec3649790e948299b43bc522ee6d3fc9d10f769
- SHA256
  
  fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4
- SHA512
  
  6c4f76b35b0a90ca8e132d20a3b9d0eaf4752c6c49efe9a6f180b3b7a2091af55f8cab0be881e499a90da496ccbce7550eba4d8a3bc124060b429d44fb08e0a0
- SSDEEP
  
  49152:1Djlabwz9WV429A3twp/pZ5zUg45hGUrf/osAX4RUhpKT/+qYiv:Zqw+T9ewpRzz6OUkR4R7TmqYK
Score

10^/10

dcrat discovery infostealer persistence rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratdiscoveryinfostealerpersistencerat

behavioral2

dcratdiscoveryinfostealerpersistencerat