Overview

overview

10

Static

static

3

fc7c1ae206...7f.exe

windows7-x64

10

fc7c1ae206...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc7c1ae206763de95cdfd31d847ca4a6ecdcd0ee4d1fa30dc6c9e29d6f85877f.exe

  • Size

    2.0MB

  • Sample

    250129-ean6nasrdq

  • MD5

    15af6864baf346e9b5fa1430a056e1a8

  • SHA1

    5ad0dfff7f611bb92ee3d3f24323f4dd9c7d5562

  • SHA256

    fc7c1ae206763de95cdfd31d847ca4a6ecdcd0ee4d1fa30dc6c9e29d6f85877f

  • SHA512

    aa9c756d9112da082f097f54d0e49b6229639a0e35277dbd560f7623aa01603b542db06d50bfea298e45b66212b32b7677d5d1ab20c75c275e32f743c26bf495

  • SSDEEP

    24576:BhnLIfy0Y3sDsvEeuXKWdd0wrT8aF/2FFL64FHFEVI1PYAXFeTiEHyG0GieYAOe/:fgNPZdzkaFO7WeYgFeGESG01eYAU7Y

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      fc7c1ae206763de95cdfd31d847ca4a6ecdcd0ee4d1fa30dc6c9e29d6f85877f.exe

    • Size

      2.0MB

    • MD5

      15af6864baf346e9b5fa1430a056e1a8

    • SHA1

      5ad0dfff7f611bb92ee3d3f24323f4dd9c7d5562

    • SHA256

      fc7c1ae206763de95cdfd31d847ca4a6ecdcd0ee4d1fa30dc6c9e29d6f85877f

    • SHA512

      aa9c756d9112da082f097f54d0e49b6229639a0e35277dbd560f7623aa01603b542db06d50bfea298e45b66212b32b7677d5d1ab20c75c275e32f743c26bf495

    • SSDEEP

      24576:BhnLIfy0Y3sDsvEeuXKWdd0wrT8aF/2FFL64FHFEVI1PYAXFeTiEHyG0GieYAOe/:fgNPZdzkaFO7WeYgFeGESG01eYAU7Y

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks