Overview

overview

10

Static

static

10

Proverka by xdwd.exe

windows7-x64

10

Proverka by xdwd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Proverka by xdwd.bat

  • Size

    1.5MB

  • Sample

    250119-n24vvswldx

  • MD5

    b6d84083a9a6d904f8fce712472503db

  • SHA1

    be3cea644584be972eed12578bdcf3cd6ff4ecbb

  • SHA256

    7386643d99fbe783380f85fa364cce332c31ff0bdf023b78de58d329990842ad

  • SHA512

    0cca303cc79bd20a593e1d5a01cce8783c7daffa4c99cf1694dfdaa5c14b7e7be64a35f73e9b8f7063948a94b492c830d32870965ba7fd0f0d067d06b9806539

  • SSDEEP

    24576:U2G/nvxW3Ww0tNAo6ME182LavUt3U27dLqYTZb0yJSogzbKRYSDxtXbkP0hNZnB:UbA30NAF8MIGfQ/Km6XoP05B

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      Proverka by xdwd.bat

    • Size

      1.5MB

    • MD5

      b6d84083a9a6d904f8fce712472503db

    • SHA1

      be3cea644584be972eed12578bdcf3cd6ff4ecbb

    • SHA256

      7386643d99fbe783380f85fa364cce332c31ff0bdf023b78de58d329990842ad

    • SHA512

      0cca303cc79bd20a593e1d5a01cce8783c7daffa4c99cf1694dfdaa5c14b7e7be64a35f73e9b8f7063948a94b492c830d32870965ba7fd0f0d067d06b9806539

    • SSDEEP

      24576:U2G/nvxW3Ww0tNAo6ME182LavUt3U27dLqYTZb0yJSogzbKRYSDxtXbkP0hNZnB:UbA30NAF8MIGfQ/Km6XoP05B

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks