Overview

overview

10

Static

static

10

D0CD2568BF...AB.exe

windows7-x64

10

D0CD2568BF...AB.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    D0CD2568BF153709F5ED4491BD8534AB.exe

  • Size

    826KB

  • Sample

    250122-pp14waxlem

  • MD5

    d0cd2568bf153709f5ed4491bd8534ab

  • SHA1

    070e2b33bd4e51417eb1ac74301f25afb35d7ec2

  • SHA256

    4d77c973871f6870b7adb2703dcfa7d1941d12aaf6ad761f0d7cdd94092db798

  • SHA512

    0ea13e0dff1c362eeb02f75ebef502a3605f5c381082f05548dfd0213cdc78aa90757876f9bae5348255794645a99eb83a0c72fb27e64d4b1c02d9d0cc1c6b98

  • SSDEEP

    12288:82NE1Iv7VIWfLEcNif4F4aJHIi4ENQj0SeyZIZOJ59bsAzeA7:e1aV9fLofI4aVNYGZ059bNyI

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      D0CD2568BF153709F5ED4491BD8534AB.exe

    • Size

      826KB

    • MD5

      d0cd2568bf153709f5ed4491bd8534ab

    • SHA1

      070e2b33bd4e51417eb1ac74301f25afb35d7ec2

    • SHA256

      4d77c973871f6870b7adb2703dcfa7d1941d12aaf6ad761f0d7cdd94092db798

    • SHA512

      0ea13e0dff1c362eeb02f75ebef502a3605f5c381082f05548dfd0213cdc78aa90757876f9bae5348255794645a99eb83a0c72fb27e64d4b1c02d9d0cc1c6b98

    • SSDEEP

      12288:82NE1Iv7VIWfLEcNif4F4aJHIi4ENQj0SeyZIZOJ59bsAzeA7:e1aV9fLofI4aVNYGZ059bNyI

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks