dcrat | 1c0a9400bebcc834e63c18d20f9bf0ab073faa9525112178e2507072542e00a7

General

Target
FiveM_External.exe
Size 8.2MB
Sample260910-2rnmsafa24
SHA256 1c0a9400bebcc834e63c18d20f9bf0ab073faa9525112178e2507072542e00a7
MD5 a3988c100166cddfe804578aaea0b946
SHA1 8107f9549c5077939e5f8665be80c1f21f3378ed
SHA512 bc606729bb194377b2f2ebb0e92dfd9251810b543e1774bab6155b2b06e3ee6fb4f780e925ce419b62bc4718bc5763ddce26f6027f9f835b86c152511df0c20a
SSDEEP 196608:sXjbVCIBF9P4xemNhsbq1H5aoLz+SLnVrLIs3KK3D3jNLT8:wjIIrt4xVNhSK5LLqSJJ3KKDp/
TLSH
T17E86330625B9D8B1CCD3C1B4CA9BBBD892553DB83AFC0783E9503C4A775B1A4691C3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  FiveM_External.exe
- Size 8.2MB
- SHA256 1c0a9400bebcc834e63c18d20f9bf0ab073faa9525112178e2507072542e00a7
- MD5 a3988c100166cddfe804578aaea0b946
- SHA1 8107f9549c5077939e5f8665be80c1f21f3378ed
- SHA512 bc606729bb194377b2f2ebb0e92dfd9251810b543e1774bab6155b2b06e3ee6fb4f780e925ce419b62bc4718bc5763ddce26f6027f9f835b86c152511df0c20a
- SSDEEP 196608:sXjbVCIBF9P4xemNhsbq1H5aoLz+SLnVrLIs3KK3D3jNLT8:wjIIrt4xVNhSK5LLqSJJ3KKDp/
- TLSH
  T17E86330625B9D8B1CCD3C1B4CA9BBBD892553DB83AFC0783E9503C4A775B1A4691C3AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit dcrat infostealer persistence rat
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Family: DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Modifies security service
  defense_evasion
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2