Overview

overview

10

Static

static

10

DCRatBuild.exe

windows7-x64

10

DCRatBuild.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DCRatBuild.exe

  • Size

    1.5MB

  • Sample

    250119-n31jtswlg1

  • MD5

    2dfe08213d4a88f84c8e6e55b1baf0fa

  • SHA1

    0840c87abf9b8f5bd39a590ac3be226d6cf125a3

  • SHA256

    05f3d9ce16eba5ebb4ed29d62529eeec7c533f0ec87f97f14f2b7f46969e0061

  • SHA512

    e327ebcf5b9d83204511587ee01102f88a4564d5e048cc4bff43098e98b08d4bf29cbb2e28a073d732075c4469cce0b3bd6b5f711f26beba8af587f9120f7900

  • SSDEEP

    24576:U2G/nvxW3Ww0t0nvhF84x1Ew037zQMG9iw3g21vWzKaShD9YrBy64bU:UbA30SvE4xwU9iKg21SdSwVym

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      DCRatBuild.exe

    • Size

      1.5MB

    • MD5

      2dfe08213d4a88f84c8e6e55b1baf0fa

    • SHA1

      0840c87abf9b8f5bd39a590ac3be226d6cf125a3

    • SHA256

      05f3d9ce16eba5ebb4ed29d62529eeec7c533f0ec87f97f14f2b7f46969e0061

    • SHA512

      e327ebcf5b9d83204511587ee01102f88a4564d5e048cc4bff43098e98b08d4bf29cbb2e28a073d732075c4469cce0b3bd6b5f711f26beba8af587f9120f7900

    • SSDEEP

      24576:U2G/nvxW3Ww0t0nvhF84x1Ew037zQMG9iw3g21vWzKaShD9YrBy64bU:UbA30SvE4xwU9iKg21SdSwVym

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks