dcrat | 2c72479cc49731a95d2953c70e8ccf3a11eb154532aae68a7e7c7290797cb728 | Triage

Sharing

General

Target

2c72479cc49731a95d2953c70e8ccf3a11eb154532aae68a7e7c7290797cb728.exe
Size

1.8MB
Sample

250203-dp7qwazmer
MD5

fcd38cbaa3982793517697bf89f666cc
SHA1

c345ceffabb9decaaa1e7a4f9582313401cbd589
SHA256

2c72479cc49731a95d2953c70e8ccf3a11eb154532aae68a7e7c7290797cb728
SHA512

8c5b64aa64dbc494e413b4e83b21c4f9bb0e3dd684a601c4faf1896e2f7d13cdb0885405b17839390358f823f4d61ea608b14f14e3f98d52a03778be64df0b9d
SSDEEP

24576:QNHIUS4ZU8NigrQ1JKwsy3CL3sZb2W2LimA2putPYrrJUHJZ5HwhJ5Ji2aaf1kWT:oII8LFCL3sZqd204AKHFgTI2aU1kW

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Targets

- Target
  
  2c72479cc49731a95d2953c70e8ccf3a11eb154532aae68a7e7c7290797cb728.exe
- Size
  
  1.8MB
- MD5
  
  fcd38cbaa3982793517697bf89f666cc
- SHA1
  
  c345ceffabb9decaaa1e7a4f9582313401cbd589
- SHA256
  
  2c72479cc49731a95d2953c70e8ccf3a11eb154532aae68a7e7c7290797cb728
- SHA512
  
  8c5b64aa64dbc494e413b4e83b21c4f9bb0e3dd684a601c4faf1896e2f7d13cdb0885405b17839390358f823f4d61ea608b14f14e3f98d52a03778be64df0b9d
- SSDEEP
  
  24576:QNHIUS4ZU8NigrQ1JKwsy3CL3sZb2W2LimA2putPYrrJUHJZ5HwhJ5Ji2aaf1kWT:oII8LFCL3sZqd204AKHFgTI2aU1kW
Score

10^/10

dcrat discovery infostealer persistence rat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratdiscoveryinfostealerpersistencerat

behavioral2

dcratdiscoveryinfostealerpersistencerat