Overview

overview

10

Static

static

10

383cad8eb4...0a.exe

windows7-x64

10

383cad8eb4...0a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    383cad8eb4744a1be8c2b17c74b97b0a.exe

  • Size

    1.2MB

  • Sample

    250129-hw34gstpes

  • MD5

    383cad8eb4744a1be8c2b17c74b97b0a

  • SHA1

    23ccdd08ba293d56ac66b682b57585a85e1742a1

  • SHA256

    fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b

  • SHA512

    713896072fd43a6566c895ff96f47fb13442864004e1977a79632818537fdf42401fe0659b2ffe21cdf30a097c5d1576b8856046629822cede88f5f77c0a275d

  • SSDEEP

    24576:MATnwO965z/roRbcJEV2oLI2gDMwifE+O3jV5kF9BrK:XuaKEEgTBr

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      383cad8eb4744a1be8c2b17c74b97b0a.exe

    • Size

      1.2MB

    • MD5

      383cad8eb4744a1be8c2b17c74b97b0a

    • SHA1

      23ccdd08ba293d56ac66b682b57585a85e1742a1

    • SHA256

      fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b

    • SHA512

      713896072fd43a6566c895ff96f47fb13442864004e1977a79632818537fdf42401fe0659b2ffe21cdf30a097c5d1576b8856046629822cede88f5f77c0a275d

    • SSDEEP

      24576:MATnwO965z/roRbcJEV2oLI2gDMwifE+O3jV5kF9BrK:XuaKEEgTBr

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks