dcrat | 20e9dafaa42a6b6122ecc150622cf8aabe7a324527df144561de5ba0b486ab2a | Triage

Sharing

General

Target

Discord.exe
Size

1.8MB
Sample

250208-1ldd7awrhn
MD5

b5c4fa68d74ab47092a46241d6b10a16
SHA1

e754f10c51933c1ef98782fbf695e8f21198fe7e
SHA256

20e9dafaa42a6b6122ecc150622cf8aabe7a324527df144561de5ba0b486ab2a
SHA512

3ab67cb936cab9eb89bb8275309cbc5f56d7f03e554b5cc7bd54305c282b6e8a0feb4af8c1ebc7073d63c371444751c522b030748b4d57c28a768fd6cfdb5293
SSDEEP

24576:xoGjZgFKRWhFSJVRNkiPmfqbvi5iqOlK565cvugnpQS2/DS7w0KksrSTkdu+vNph:xav+RxbvikJj4npQS2/DSs6YVz7sD

Score

10^/10

dcrat discovery infostealer rat spyware stealer

Malware Config

Targets

- Target
  
  Discord.exe
- Size
  
  1.8MB
- MD5
  
  b5c4fa68d74ab47092a46241d6b10a16
- SHA1
  
  e754f10c51933c1ef98782fbf695e8f21198fe7e
- SHA256
  
  20e9dafaa42a6b6122ecc150622cf8aabe7a324527df144561de5ba0b486ab2a
- SHA512
  
  3ab67cb936cab9eb89bb8275309cbc5f56d7f03e554b5cc7bd54305c282b6e8a0feb4af8c1ebc7073d63c371444751c522b030748b4d57c28a768fd6cfdb5293
- SSDEEP
  
  24576:xoGjZgFKRWhFSJVRNkiPmfqbvi5iqOlK565cvugnpQS2/DS7w0KksrSTkdu+vNph:xav+RxbvikJj4npQS2/DSs6YVz7sD
Score

10^/10

dcrat infostealer rat spyware stealer discovery
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Dcrat family
  dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dcratinfostealerratspywarestealer

behavioral2

dcratdiscoveryinfostealerratspywarestealer