Extracted

• • Target

    skillprotectV2.exe

  • Size

    226KB

  • MD5

    309c2c3c3bf0c657af55e0f26117ab03

  • SHA1

    749be0ef8828086b20a292b5e71da4f52e2a9416

  • SHA256

    7bc24cf4fdcb184014b58751e2147d9161517808c3db3779fc41915fb493c87e

  • SHA512

    e81578aff2cd6ff96f5564d043a20682a6e381a03d71e1326c9ef9c896b886956f9bf984e4e75eb232dc692295a12d942938bfbae06515f1b75fdda4af1c1dc5

  • SSDEEP

    3072:UsZpi2QxmGgbGDyyOo9dhtrBTVgwby94wZxJzQyW:Usbi2QxYGDxbL1W91z

  Score

  10^/10

  dcratphemedronecredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerpersistenceratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Dcrat family

    dcrat

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Phemedrone family

    phemedrone

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • DCRat payload

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Suspicious use of SetThreadContext

  behavioral1