Overview

overview

10

Static

static

10

76e7d1b53c...ba.exe

windows7-x64

10

76e7d1b53c...ba.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76e7d1b53c84ccbf7789386bdeffc58d4171f2fbfa650891e980ccc6f77789ba.exe

  • Size

    1.1MB

  • Sample

    250120-e3748s1mcy

  • MD5

    f6ce84a3177d88fd779e990ecd08c5b3

  • SHA1

    421a718c107138941a908abc5a5ec608f2ff1121

  • SHA256

    76e7d1b53c84ccbf7789386bdeffc58d4171f2fbfa650891e980ccc6f77789ba

  • SHA512

    f3a721633d9e4d5c0376ebf638e05d454ebd6f75d2cdd842e173c9dc2b1568f686a96ef4d737426dc56ffafe4e28fd56abffa29986c375834b5a4348bcde6770

  • SSDEEP

    24576:U2G/nvxW3Ww0tqNUI8y/hByvMnRxzbL6mcYUJV2Vzl:UbA30MF/hRwfMx

Score
10/10
dcratdiscoveryevasioninfostealerrat

Malware Config

Targets

    • Target

      76e7d1b53c84ccbf7789386bdeffc58d4171f2fbfa650891e980ccc6f77789ba.exe

    • Size

      1.1MB

    • MD5

      f6ce84a3177d88fd779e990ecd08c5b3

    • SHA1

      421a718c107138941a908abc5a5ec608f2ff1121

    • SHA256

      76e7d1b53c84ccbf7789386bdeffc58d4171f2fbfa650891e980ccc6f77789ba

    • SHA512

      f3a721633d9e4d5c0376ebf638e05d454ebd6f75d2cdd842e173c9dc2b1568f686a96ef4d737426dc56ffafe4e28fd56abffa29986c375834b5a4348bcde6770

    • SSDEEP

      24576:U2G/nvxW3Ww0tqNUI8y/hByvMnRxzbL6mcYUJV2Vzl:UbA30MF/hRwfMx

    Score
    10/10
    dcratdiscoveryevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks