Overview

overview

10

Static

static

10

c961f509d3...2e.exe

windows7-x64

10

c961f509d3...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c961f509d3a8ff2347a68f424eab0d2e.exe

  • Size

    1.5MB

  • Sample

    250208-mq6pms1pdk

  • MD5

    c961f509d3a8ff2347a68f424eab0d2e

  • SHA1

    da8ea51829b79720247c4c74b7838a7c108c847f

  • SHA256

    95a53f6f1269cbfa5dd44e1d53d1206f33ba9fbdf18fc34ce68facbb84529a99

  • SHA512

    96cb67b386035aa7e44a5b398aa4773e9991c85ebd042872e2a02faa1c88c0125f5355423aa51f81d124232390ae1f107a8dd96c7745211ee299872882dba580

  • SSDEEP

    24576:u2G/nvxW3WieCYfUmSxpTSwXc/PkRBZEW6kaRe/qtWE0FI+WAEv8jy:ubA3jvmSx1Xc/swY/qt0FsA2r

Score
10/10
dcratdefense_evasiondiscoveryinfostealerrat

Malware Config

Targets

    • Target

      c961f509d3a8ff2347a68f424eab0d2e.exe

    • Size

      1.5MB

    • MD5

      c961f509d3a8ff2347a68f424eab0d2e

    • SHA1

      da8ea51829b79720247c4c74b7838a7c108c847f

    • SHA256

      95a53f6f1269cbfa5dd44e1d53d1206f33ba9fbdf18fc34ce68facbb84529a99

    • SHA512

      96cb67b386035aa7e44a5b398aa4773e9991c85ebd042872e2a02faa1c88c0125f5355423aa51f81d124232390ae1f107a8dd96c7745211ee299872882dba580

    • SSDEEP

      24576:u2G/nvxW3WieCYfUmSxpTSwXc/PkRBZEW6kaRe/qtWE0FI+WAEv8jy:ubA3jvmSx1Xc/swY/qt0FsA2r

    Score
    10/10
    dcratdefense_evasiondiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      defense_evasion

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks