dcrat | 70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21

Analysis

max time kernel
118s
max time network
44s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
Size 3.6MB
Sample201109-drzbrnmdes
SHA256 70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21
MD5 a6e291abfc9187787101f632e8f61111
SHA1 f7cf6ac8b8e2636bb813ae10e657600f9715e8c1
SHA512 2400862d55b5d928c179506e42604c1dec78ec727d4640a8044052b2fed89541205b0d64d80171f3bef94624c3d51efeaef3ed6a3df6330f5f7607626d881526
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat upx

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Executes dropped EXE 3 IoCs

pid	Process
2028	DCRatBuild.exe
1468	Netflixer v1.0.exe
1976	reviewinto.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000130f0-0.dat	upx
behavioral1/files/0x00050000000130f0-2.dat	upx
behavioral1/files/0x00050000000130f0-1.dat	upx
behavioral1/files/0x00050000000130f0-4.dat	upx
behavioral1/files/0x00050000000130f0-11.dat	upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	cmd.exe

Loads dropped DLL 13 IoCs

pid	Process
288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe
288	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
436	1468	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe
1976	reviewinto.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
436	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	WerFault.exe
Token: SeDebugPrivilege	1976	reviewinto.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 2028	288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe	26
PID 288 wrote to memory of 2028	288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe	26
PID 288 wrote to memory of 2028	288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe	26
PID 288 wrote to memory of 2028	288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe	26
PID 288 wrote to memory of 1468	288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe	27
PID 288 wrote to memory of 1468	288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe	27
PID 288 wrote to memory of 1468	288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe	27
PID 288 wrote to memory of 1468	288	70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe	27
PID 2028 wrote to memory of 316	2028	DCRatBuild.exe	29
PID 2028 wrote to memory of 316	2028	DCRatBuild.exe	29
PID 2028 wrote to memory of 316	2028	DCRatBuild.exe	29
PID 2028 wrote to memory of 316	2028	DCRatBuild.exe	29
PID 1468 wrote to memory of 436	1468	Netflixer v1.0.exe	30
PID 1468 wrote to memory of 436	1468	Netflixer v1.0.exe	30
PID 1468 wrote to memory of 436	1468	Netflixer v1.0.exe	30
PID 1468 wrote to memory of 436	1468	Netflixer v1.0.exe	30
PID 316 wrote to memory of 288	316	WScript.exe	34
PID 316 wrote to memory of 288	316	WScript.exe	34
PID 316 wrote to memory of 288	316	WScript.exe	34
PID 316 wrote to memory of 288	316	WScript.exe	34
PID 288 wrote to memory of 1976	288	cmd.exe	36
PID 288 wrote to memory of 1976	288	cmd.exe	36
PID 288 wrote to memory of 1976	288	cmd.exe	36
PID 288 wrote to memory of 1976	288	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
"C:\Users\Admin\AppData\Local\Temp\70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:288
- C:\Users\Admin\AppData\Roaming\8iIALM2eDvdOyvBKy\DCRatBuild.exe
  "C:\Users\Admin\AppData\Roaming\8iIALM2eDvdOyvBKy\DCRatBuild.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\runtimeperf\System.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:316
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\runtimeperf\o4a71YPn3Qcr4qazAb6KaqQivTzcYG.bat" "
      4⤵
      Drops startup file
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:288
    - - C:\runtimeperf\reviewinto.exe
        
        "C:\runtimeperf\reviewinto.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
- C:\Users\Admin\AppData\Roaming\8iIALM2eDvdOyvBKy\Netflixer v1.0.exe
  "C:\Users\Admin\AppData\Roaming\8iIALM2eDvdOyvBKy\Netflixer v1.0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 748
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-38-0x0000000002750000-0x0000000002754000-memory.dmp

Download

memory/436-35-0x0000000002490000-0x00000000024A1000-memory.dmp

Download

memory/436-33-0x0000000002490000-0x00000000024A1000-memory.dmp

Download

memory/436-21-0x0000000002050000-0x0000000002061000-memory.dmp

Download

memory/1468-19-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/1468-18-0x00000000023E0000-0x0000000002400000-memory.dmp

Download

memory/1468-15-0x0000000000400000-0x0000000000402000-memory.dmp

Download

memory/1468-13-0x0000000073D80000-0x000000007446E000-memory.dmp

Download

memory/1976-44-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Download

memory/1976-45-0x0000000001300000-0x0000000001301000-memory.dmp

Download

memory/1976-47-0x000000001B6A0000-0x000000001B9EE000-memory.dmp

Download

memory/1976-48-0x00000000007C0000-0x000000000080D000-memory.dmp

Download

memory/1976-49-0x000000001A940000-0x000000001A9CD000-memory.dmp

Download

memory/1976-50-0x0000000000590000-0x000000000059F000-memory.dmp

Download

memory/1976-51-0x000000001A9D0000-0x000000001AA45000-memory.dmp

Download