Overview

overview

10

Static

static

3

12b1d02123...94.exe

windows7-x64

10

12b1d02123...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe

  • Size

    13.5MB

  • Sample

    240701-bdcp9a1ekb

  • MD5

    a26a308a71c3fd57cd4fad9dc8d55fb1

  • SHA1

    3722d8d2b321f72b2e207a8e1f7e408d35c7d607

  • SHA256

    12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694

  • SHA512

    306868bb537ffae0a7cd4de76b0f52079b2aa5f744f50abe3a866f4bb2f17a829cb91537a30c76240798248a0e9da6d5f92591ed1e7101337e2aa0f78e764e55

  • SSDEEP

    393216:n5BbqQ/ThnhIxo1S/Js7D+xZlwRjMAke5F:5P4xy0ADFRYAj

Score
10/10
dcratbootkitinfostealerpersistencerat

Malware Config

Targets

    • Target

      12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe

    • Size

      13.5MB

    • MD5

      a26a308a71c3fd57cd4fad9dc8d55fb1

    • SHA1

      3722d8d2b321f72b2e207a8e1f7e408d35c7d607

    • SHA256

      12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694

    • SHA512

      306868bb537ffae0a7cd4de76b0f52079b2aa5f744f50abe3a866f4bb2f17a829cb91537a30c76240798248a0e9da6d5f92591ed1e7101337e2aa0f78e764e55

    • SSDEEP

      393216:n5BbqQ/ThnhIxo1S/Js7D+xZlwRjMAke5F:5P4xy0ADFRYAj

    Score
    10/10
    dcratbootkitinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks