Overview

overview

10

Static

static

10

xlib86.exe

windows7-x64

10

xlib86.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xlib86.exe

  • Size

    624KB

  • Sample

    250327-rb1x3asyfs

  • MD5

    15d1f00d56be9a75ef838df7296fd36e

  • SHA1

    eaecc49bebee74cd142af04ba5047acfc1c10db2

  • SHA256

    0295fc7acaed48393649e69a4a604a682afd9fa832d6c69ba5a0ed6f15471fe4

  • SHA512

    9f61f4350ef961b9ef29930f9fcfca0b756cb8fe1b48707b6be591cdfd71f1347996566bfb89cdb543ee39d2ad899019a7638429f340f6351d5043258933e437

  • SSDEEP

    12288:URZ+IoG/n9IQxW3OBseUUT+tcYbga2N7O+WJu/Z9kBTdxFZA:u2G/nvxW3WieCga2LGMkLxFi

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      xlib86.exe

    • Size

      624KB

    • MD5

      15d1f00d56be9a75ef838df7296fd36e

    • SHA1

      eaecc49bebee74cd142af04ba5047acfc1c10db2

    • SHA256

      0295fc7acaed48393649e69a4a604a682afd9fa832d6c69ba5a0ed6f15471fe4

    • SHA512

      9f61f4350ef961b9ef29930f9fcfca0b756cb8fe1b48707b6be591cdfd71f1347996566bfb89cdb543ee39d2ad899019a7638429f340f6351d5043258933e437

    • SSDEEP

      12288:URZ+IoG/n9IQxW3OBseUUT+tcYbga2N7O+WJu/Z9kBTdxFZA:u2G/nvxW3WieCga2LGMkLxFi

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks