Overview

overview

10

Static

static

10

da55b07483...dN.exe

windows7-x64

10

da55b07483...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da55b07483858fc038855e7aa1290036419f9dadb362c510951d20385106584dN.exe

  • Size

    1.2MB

  • Sample

    250201-1af1yasram

  • MD5

    93beba30961d66c4bf317a91e2ceab60

  • SHA1

    5c394cf0254b1eebb9a978556ce6d94f8fced169

  • SHA256

    da55b07483858fc038855e7aa1290036419f9dadb362c510951d20385106584d

  • SHA512

    9a7ed86f099c7ab52357cc846e3d872bf4e9f33e3792e16395200e1c4cc9e0b491a94eb45430c202da50a4f2bdb23f0d7d2bcaa4aefe735996462f9789a0ae7d

  • SSDEEP

    24576:O2G/nvxW3WY3h0KomE5c7JtTE/TWsO8Mxj:ObA3x3GKCuP3AMp

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      da55b07483858fc038855e7aa1290036419f9dadb362c510951d20385106584dN.exe

    • Size

      1.2MB

    • MD5

      93beba30961d66c4bf317a91e2ceab60

    • SHA1

      5c394cf0254b1eebb9a978556ce6d94f8fced169

    • SHA256

      da55b07483858fc038855e7aa1290036419f9dadb362c510951d20385106584d

    • SHA512

      9a7ed86f099c7ab52357cc846e3d872bf4e9f33e3792e16395200e1c4cc9e0b491a94eb45430c202da50a4f2bdb23f0d7d2bcaa4aefe735996462f9789a0ae7d

    • SSDEEP

      24576:O2G/nvxW3WY3h0KomE5c7JtTE/TWsO8Mxj:ObA3x3GKCuP3AMp

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks