dcrat

Resubmissions

13-01-2025 05:28

250113-f59araxqfz 10

12-01-2025 19:36

250112-ybg9aaylfr 10

Sharing

Copy URL

Twitter E-mail

General

Target

10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Size

1.7MB
Sample

250113-f59araxqfz
MD5

a95c577913d17f1786babed3306fed60
SHA1

16106bfac76f6e4f711a9dd7e016cd52fbaeb774
SHA256

10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91
SHA512

314edb12b8885f8f9ea83e991b49aafcc629d5325f3439460610cc0046f0f0d1d629cecd79c2a9c48899d07c171253be7e65a6ef27c1434cf5ff55d5043fdec0
SSDEEP

24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:NgwuuEpdDLNwVMeXDL0fdSzAG

Score

10^/10

Malware Config

Targets

- Target
  
  10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
- Size
  
  1.7MB
- MD5
  
  a95c577913d17f1786babed3306fed60
- SHA1
  
  16106bfac76f6e4f711a9dd7e016cd52fbaeb774
- SHA256
  
  10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91
- SHA512
  
  314edb12b8885f8f9ea83e991b49aafcc629d5325f3439460610cc0046f0f0d1d629cecd79c2a9c48899d07c171253be7e65a6ef27c1434cf5ff55d5043fdec0
- SSDEEP
  
  24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:NgwuuEpdDLNwVMeXDL0fdSzAG
Score

10^/10

dcrat execution infostealer rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Dcrat family

Process spawned unexpected child process

DCRat payload

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10