Overview

overview

10

Static

static

3

e7fb15dc10...a6.exe

windows7-x64

10

e7fb15dc10...a6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    50ee114bba99ce3a7ba3e64c0080a644.bin

  • Size

    1.7MB

  • Sample

    250113-bpptys1nbn

  • MD5

    de783830a09fa9dc933995ae6cd1b320

  • SHA1

    b49d8cb8a194843c203a987c1a786d96252e5f3e

  • SHA256

    18f98cf70e93f573af35a3f74fc6bf092d249b554336320f6c17a8925c35f8bb

  • SHA512

    937dc4ae618f9e099208d7cfecbc8183dd9a6e5a4d7a95e39152ced25fabe4d2cc4830c979251a09cf9ab1256ec0877552972b91b400fcdf88b34daa4560b4f3

  • SSDEEP

    24576:VC6eF5Q1wduDN8T4OfopBo+vn9IHKnrgrMRiMV0oRNTWTUrVuXyZfnJb4/SU4FSD:V92Qqd8Boq9IPbM72Uc0nt46soQoGMO

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      e7fb15dc103eca61803e214b533fb4dd3fa3d4b171886f452eb6ab8353ee2aa6.exe

    • Size

      2.2MB

    • MD5

      50ee114bba99ce3a7ba3e64c0080a644

    • SHA1

      3c9f1189b07b612888a1124714d1586408c78ba0

    • SHA256

      e7fb15dc103eca61803e214b533fb4dd3fa3d4b171886f452eb6ab8353ee2aa6

    • SHA512

      58b94a8596d4a94b28da6f0051d90bf098d9def8a112d9541eca814c7b46f5bae619a331831c060eff04f39b62cac1a2ad2a5fe380c75f59aa79322e09a4b64d

    • SSDEEP

      49152:IBJaWLMtwyMxRizAwgueOJNN3lRHiKLWDWUs:yALwyMb9ue0NTH2Ps

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks