Overview

overview

10

Static

static

10

9bf9efa06f...b7.exe

windows7-x64

10

9bf9efa06f...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08e95dabb86201eeb98188769e4fcd62.bin

  • Size

    595KB

  • Sample

    250109-bcwrqstmer

  • MD5

    ad6a783f5d1757053b5f2dbcd7551009

  • SHA1

    3ce91efa36f6ced728c1955a7ffbfdf3cc8f96c2

  • SHA256

    874a2c7f2a2f39efe570bde5a76a28199fc8a063281b75d6d59a5f1b044ccc84

  • SHA512

    efe024747013f52885e5e1951983724bd65f31780bd61b615a029de35c0f14a3b092260ab50bf5a9f50f5960ffced42158df4cd71c5fbb199068bab5bc170e65

  • SSDEEP

    12288:PHASc+yWfwD3cEdrbTsZBNNQaN35hY3uDbjelG13WSFVreXe0:vAS3yMW3vgBNN+enylO3WSFVreXd

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      9bf9efa06f63a21c9893e1acfa2ae7838ab3bdcb7d768ef6304756845395bfb7.exe

    • Size

      1.1MB

    • MD5

      08e95dabb86201eeb98188769e4fcd62

    • SHA1

      40a819d79a67c7be05f9c0c45ee7558ec58971f9

    • SHA256

      9bf9efa06f63a21c9893e1acfa2ae7838ab3bdcb7d768ef6304756845395bfb7

    • SHA512

      7d9b35d175f4a0c90a48c44930e7f8260e4a16821b4c778bc5fcb1d5a220d29d29520f7b1809918eb5e03dfd16a6dfcfac3fcbfd4cebabcdd38776c5508cf722

    • SSDEEP

      24576:U2G/nvxW3Ww0tE9E3RrEdapg6gnUcKnbXq5Qck:UbA30E9ldapLpkQl

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks