Overview

overview

10

Static

static

3

1.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1.exe

  • Size

    2.1MB

  • Sample

    250128-yw247atjbl

  • MD5

    261edf92e8d85c7a9f7151080ea80467

  • SHA1

    be7cba5291a89ccaed22bfb092a7651d34a36def

  • SHA256

    e21cfe74517aaaad37fd5b4825fa4eb97edc6c8daeb386e0cf562b5901f7fdeb

  • SHA512

    bec64fce5dc2a93edf16963236c975409ca4f40c8809e6a16661578d99ff0fd09178c0d7c293211f6da2419342e71e9532f17d6e455a5ef573326c4fa7fb7c8c

  • SSDEEP

    24576:2TbBv5rUyXVcPzRN7hPeAb+kB559xtG4qPj4wYoyaOufGW26fydwYGfIlDl/DX/p:IBJcoAb+WxttdgyaOuJ2Myccbx

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      1.exe

    • Size

      2.1MB

    • MD5

      261edf92e8d85c7a9f7151080ea80467

    • SHA1

      be7cba5291a89ccaed22bfb092a7651d34a36def

    • SHA256

      e21cfe74517aaaad37fd5b4825fa4eb97edc6c8daeb386e0cf562b5901f7fdeb

    • SHA512

      bec64fce5dc2a93edf16963236c975409ca4f40c8809e6a16661578d99ff0fd09178c0d7c293211f6da2419342e71e9532f17d6e455a5ef573326c4fa7fb7c8c

    • SSDEEP

      24576:2TbBv5rUyXVcPzRN7hPeAb+kB559xtG4qPj4wYoyaOufGW26fydwYGfIlDl/DX/p:IBJcoAb+WxttdgyaOuJ2Myccbx

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks