Overview

overview

10

Static

static

10

224c366651...d0.exe

windows10-2004-x64

10

Resubmissions

13-01-2025 15:25

250113-st1kpawrdv 10

10-01-2025 12:54

250110-p5j6asxjdk 10

28-12-2024 02:09

241228-clcwnatnby 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe

  • Size

    1.1MB

  • Sample

    250113-st1kpawrdv

  • MD5

    c1ea7d9d2b92b29bb016dc0c82ce0136

  • SHA1

    0490c1a2a2ab084cb03bbb494454380eb0a4063f

  • SHA256

    224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0

  • SHA512

    51e7c868dd506de81112d18004f2dff73b0ef7a1b7614e94977c9e389919451a3c4bdda2668358999d490ca650a340305674d7c89212a33e8d111a8064a7a116

  • SSDEEP

    24576:U2G/nvxW3Ww0tLh6X9jiDf3b8goWoMSCUH0N:UbA30cQoSP

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe

    • Size

      1.1MB

    • MD5

      c1ea7d9d2b92b29bb016dc0c82ce0136

    • SHA1

      0490c1a2a2ab084cb03bbb494454380eb0a4063f

    • SHA256

      224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0

    • SHA512

      51e7c868dd506de81112d18004f2dff73b0ef7a1b7614e94977c9e389919451a3c4bdda2668358999d490ca650a340305674d7c89212a33e8d111a8064a7a116

    • SSDEEP

      24576:U2G/nvxW3Ww0tLh6X9jiDf3b8goWoMSCUH0N:UbA30cQoSP

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks