dcrat | 6ddfea9b6a5af2c8d1062c0377a84d0ce6601a13a6da05438278b86fc4b3de07 | Triage

Sharing

General

Target

6ddfea9b6a5af2c8d1062c0377a84d0ce6601a13a6da05438278b86fc4b3de07N.exe
Size

1.5MB
Sample

250111-mstg4azkhl
MD5

7b81efb209e9196c7cc9fcd1dec94fe0
SHA1

fd7f106b9ff78b24f103ed478c67648e392f4de5
SHA256

6ddfea9b6a5af2c8d1062c0377a84d0ce6601a13a6da05438278b86fc4b3de07
SHA512

60a7a9bafb1920dd1ade5fdcd659e5f8f6150143352b2ac7a708e95010fb89c9532f3d7e4cfd17850da60ded76c66af3d62f4f0d464a15869b13a488f2d81269
SSDEEP

24576:dbfESdvMj6hoGDAQsJ+N6XcHQWq3QY2SrXQLdok0OjYS4mej+T1kJCv:ZEi6GDAQORcwW5/oBjme81

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Targets

- Target
  
  6ddfea9b6a5af2c8d1062c0377a84d0ce6601a13a6da05438278b86fc4b3de07N.exe
- Size
  
  1.5MB
- MD5
  
  7b81efb209e9196c7cc9fcd1dec94fe0
- SHA1
  
  fd7f106b9ff78b24f103ed478c67648e392f4de5
- SHA256
  
  6ddfea9b6a5af2c8d1062c0377a84d0ce6601a13a6da05438278b86fc4b3de07
- SHA512
  
  60a7a9bafb1920dd1ade5fdcd659e5f8f6150143352b2ac7a708e95010fb89c9532f3d7e4cfd17850da60ded76c66af3d62f4f0d464a15869b13a488f2d81269
- SSDEEP
  
  24576:dbfESdvMj6hoGDAQsJ+N6XcHQWq3QY2SrXQLdok0OjYS4mej+T1kJCv:ZEi6GDAQORcwW5/oBjme81
Score

10^/10

dcrat execution infostealer persistence rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratexecutioninfostealerpersistencerat

behavioral2

dcratexecutioninfostealerpersistencerat