Overview

overview

10

Static

static

10

d705a583af...ce.exe

windows7-x64

10

d705a583af...ce.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d705a583afd303cbbbddc87d9f4de9387f2f5e10630f46ae4adee5ee5ff180ce

  • Size

    2.5MB

  • Sample

    250106-y26dsswqaw

  • MD5

    2933b54db3817abdc91b58f70ae31b71

  • SHA1

    d4b7d3a213882a16e43b37472cf40b50b6573fde

  • SHA256

    d705a583afd303cbbbddc87d9f4de9387f2f5e10630f46ae4adee5ee5ff180ce

  • SHA512

    a35552886749a4ee9d986f32a5128b81c8df83b152a40d23a16ab04e06e56873cf9b7ba90ebbaeaf14ebf08ce3504fe74941e88a6972eb376551b727725ff764

  • SSDEEP

    49152:VbA3GkdXjptfoI3eJIzQ6qTr7X3MFSu+L39lx:VbSXjptfoOeJ56qL8S9/

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      d705a583afd303cbbbddc87d9f4de9387f2f5e10630f46ae4adee5ee5ff180ce

    • Size

      2.5MB

    • MD5

      2933b54db3817abdc91b58f70ae31b71

    • SHA1

      d4b7d3a213882a16e43b37472cf40b50b6573fde

    • SHA256

      d705a583afd303cbbbddc87d9f4de9387f2f5e10630f46ae4adee5ee5ff180ce

    • SHA512

      a35552886749a4ee9d986f32a5128b81c8df83b152a40d23a16ab04e06e56873cf9b7ba90ebbaeaf14ebf08ce3504fe74941e88a6972eb376551b727725ff764

    • SSDEEP

      49152:VbA3GkdXjptfoI3eJIzQ6qTr7X3MFSu+L39lx:VbSXjptfoOeJ56qL8S9/

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks