Overview

overview

10

Static

static

10

88ElUKogRKGiq.exe

windows10-ltsc 2021-x64

88ElUKogRKGiq.exe

windows7-x64

10

88ElUKogRKGiq.exe

windows10-2004-x64

10

88ElUKogRKGiq.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88ElUKogRKGiq.exe

  • Size

    1.1MB

  • Sample

    250202-rd3jnswrhl

  • MD5

    98bc6986b35fa731860febb8f60de8fb

  • SHA1

    b985bdb9d2f2d6ac3085ca5f176f0a0d880bb31e

  • SHA256

    841ac24e73d5991bc0e7249257bda26329a9242829cf0e502e267725816fa2cb

  • SHA512

    92724f813370fffa7fe60ba35547e1282f2b1b521a45e6bac9bd42943c5a64519863b0c78fc9a0a38d71577b1e5e5d7a61754f6c921ec962c6b4b84e76db8e7c

  • SSDEEP

    24576:P2G/nvxW3WB0A5wH9WpcT5neONb8GM2IgYg:PbA3TA5kWIzM2P

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      88ElUKogRKGiq.exe

    • Size

      1.1MB

    • MD5

      98bc6986b35fa731860febb8f60de8fb

    • SHA1

      b985bdb9d2f2d6ac3085ca5f176f0a0d880bb31e

    • SHA256

      841ac24e73d5991bc0e7249257bda26329a9242829cf0e502e267725816fa2cb

    • SHA512

      92724f813370fffa7fe60ba35547e1282f2b1b521a45e6bac9bd42943c5a64519863b0c78fc9a0a38d71577b1e5e5d7a61754f6c921ec962c6b4b84e76db8e7c

    • SSDEEP

      24576:P2G/nvxW3WB0A5wH9WpcT5neONb8GM2IgYg:PbA3TA5kWIzM2P

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks