Overview

overview

10

Static

static

3

69cd7ad7f5...d3.exe

windows7-x64

10

69cd7ad7f5...d3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69cd7ad7f5e5c46acc5b1dfd9cd329d3.exe

  • Size

    1.6MB

  • Sample

    250208-cfmhxazpel

  • MD5

    69cd7ad7f5e5c46acc5b1dfd9cd329d3

  • SHA1

    928c973ea6e09394ce4b94eb4bd2841a348045c8

  • SHA256

    595c8307f64f1c97a3c2f2444a7e5b06c3e92a9c7de01dce0ccfea4765bdee74

  • SHA512

    8681e48a04f47facc4e103084d0f79bf64c4c1d84a6783f9b00ee138293bbffe622e0804e7f10f23750902b6bacc2a50b69f7f572744806dc5a1da94b0d99aea

  • SSDEEP

    24576:Epp1We4zjspeGmjVvjmqqHaLlzoqV8Z5k/BYUXUnSECBSxdT+8V5LY:EpXHpmjVrmqqHIz7V8ZK/GQUDWoVXL

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      69cd7ad7f5e5c46acc5b1dfd9cd329d3.exe

    • Size

      1.6MB

    • MD5

      69cd7ad7f5e5c46acc5b1dfd9cd329d3

    • SHA1

      928c973ea6e09394ce4b94eb4bd2841a348045c8

    • SHA256

      595c8307f64f1c97a3c2f2444a7e5b06c3e92a9c7de01dce0ccfea4765bdee74

    • SHA512

      8681e48a04f47facc4e103084d0f79bf64c4c1d84a6783f9b00ee138293bbffe622e0804e7f10f23750902b6bacc2a50b69f7f572744806dc5a1da94b0d99aea

    • SSDEEP

      24576:Epp1We4zjspeGmjVvjmqqHaLlzoqV8Z5k/BYUXUnSECBSxdT+8V5LY:EpXHpmjVrmqqHIz7V8ZK/GQUDWoVXL

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks