dcrat | e446bd97230671b6e38682ec9f3da7527c18dbd555efc7f27a52d144cf54edcc

Analysis

max time kernel
114s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
18-11-2020 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ForceOp 2.8.7 - By RaiSence.exe

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Executes dropped EXE 2 IoCs

Processes:

wincommon.exeWmiPrvSE.exe

pid process

628 wincommon.exe
1856 WmiPrvSE.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

384 cmd.exe

pid	process
628	wincommon.exe
1856	WmiPrvSE.exe

pid	process
384	cmd.exe

Drops file in Program Files directory 2 IoCs

Processes:

wincommon.exe

description	ioc	process
File created	C:\Program Files\Uninstall Information\System.exe	wincommon.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a	wincommon.exe

Drops file in Windows directory 2 IoCs

Processes:

wincommon.exe

description	ioc	process
File created	C:\Windows\SchCache\Idle.exe	wincommon.exe
File created	C:\Windows\SchCache\6ccacd8608530fba3a93e87ae2225c7032aa18c1	wincommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

900 schtasks.exe
1304 schtasks.exe
1452 schtasks.exe
340 schtasks.exe

pid	process
900	schtasks.exe
1304	schtasks.exe
1452	schtasks.exe
340	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

WmiPrvSE.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	WmiPrvSE.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	WmiPrvSE.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

wincommon.exeWmiPrvSE.exe

pid process

628 wincommon.exe
1856 WmiPrvSE.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

wincommon.exeWmiPrvSE.exe

description pid process

Token: SeDebugPrivilege 628 wincommon.exe
Token: SeDebugPrivilege 1856 WmiPrvSE.exe

pid	process
628	wincommon.exe
1856	WmiPrvSE.exe

description	pid	process
Token: SeDebugPrivilege	628	wincommon.exe
Token: SeDebugPrivilege	1856	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

ForceOp 2.8.7 - By RaiSence.exeWScript.execmd.exewincommon.exe

description	pid	process	target process
PID 1828 wrote to memory of 1292	1828	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 1828 wrote to memory of 1292	1828	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 1828 wrote to memory of 1292	1828	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 1828 wrote to memory of 1292	1828	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 1828 wrote to memory of 1356	1828	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 1828 wrote to memory of 1356	1828	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 1828 wrote to memory of 1356	1828	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 1828 wrote to memory of 1356	1828	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 1292 wrote to memory of 384	1292	WScript.exe	cmd.exe
PID 1292 wrote to memory of 384	1292	WScript.exe	cmd.exe
PID 1292 wrote to memory of 384	1292	WScript.exe	cmd.exe
PID 1292 wrote to memory of 384	1292	WScript.exe	cmd.exe
PID 384 wrote to memory of 628	384	cmd.exe	wincommon.exe
PID 384 wrote to memory of 628	384	cmd.exe	wincommon.exe
PID 384 wrote to memory of 628	384	cmd.exe	wincommon.exe
PID 384 wrote to memory of 628	384	cmd.exe	wincommon.exe
PID 628 wrote to memory of 1304	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 1304	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 1304	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 1452	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 1452	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 1452	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 340	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 340	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 340	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 900	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 900	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 900	628	wincommon.exe	schtasks.exe
PID 628 wrote to memory of 1856	628	wincommon.exe	WmiPrvSE.exe
PID 628 wrote to memory of 1856	628	wincommon.exe	WmiPrvSE.exe
PID 628 wrote to memory of 1856	628	wincommon.exe	WmiPrvSE.exe

C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe
"C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:384

C:\intofont\wincommon.exe
"C:\intofont\wincommon.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\PerfLogs\Admin\taskhost.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\SchCache\Idle.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1452

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:340

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\intofont\WmiPrvSE.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:900

C:\intofont\WmiPrvSE.exe
"C:\intofont\WmiPrvSE.exe"
5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\intofont\msg.vbs"
2⤵
PID:1356

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe
MD5
35f693ab095c33d4c62230d69ff6b43f

SHA1
19e8b126076b5e5d8e8b97f3757ad99357915bf4

SHA256
1a3b550ae14c360fd9600e52924706a356290939317f3a32b35bfa97b5dbc163

SHA512
1e2599c7b10a1fc5c004d7d68c487028d5d2d6a1102af0150ea0c15663819dac42e3a55a769cc532cf45f9f037cece3fcdc2820f2bfbe8439fd0a3d5a16bb4df

Download Submit
C:\intofont\MOS
MD5
cb456215c3333db0551bd0788bc258c7

SHA1
a0b861f6121344b631992c8252fa8748835e4df6

SHA256
7e7b3a01539b5dd82108fe0dc455a76294708bb782f8f7590b06f0975fdf93c1

SHA512
796ccc0f1fc4a990fe3c50f54a2d009e6ddb8e4e062ac1839a2c2c1e6f120311dad66fa86211137cb38cce27a99614085702d5fe9b6f3effc5dd1db0ad879448

Download Submit
C:\intofont\WmiPrvSE.exe
MD5
9134637118b2a4485fb46d439133749b

SHA1
25b60dba36e432f53f68603797d50b9c6cc127ce

SHA256
5dca1a463f5308018c477503a5179f45c468245dd4a84732ee824bd704521acc

SHA512
a6db12e3349c034051940b15adbb530ba34152ccbe41afc210dad7e64331221b3dbae1563a2f3b79a43d12da54eaeac3f30cfb708ebc75ab6a9dfc30a8f1e601

Download Submit
C:\intofont\WmiPrvSE.exe
MD5
9134637118b2a4485fb46d439133749b

SHA1
25b60dba36e432f53f68603797d50b9c6cc127ce

SHA256
5dca1a463f5308018c477503a5179f45c468245dd4a84732ee824bd704521acc

SHA512
a6db12e3349c034051940b15adbb530ba34152ccbe41afc210dad7e64331221b3dbae1563a2f3b79a43d12da54eaeac3f30cfb708ebc75ab6a9dfc30a8f1e601

Download Submit
C:\intofont\msg.vbs
MD5
01c71ea2d98437129936261c48403132

SHA1
dc689fb68a3e7e09a334e7a37c0d10d0641af1a6

SHA256
0401f2dd76d5ed6f90c82b72e1e7a122ef127bedbaf717532c4bba26d43a0061

SHA512
a668d4216a50ccc699221dd902d8b0f864e44368dc7474fa5659a739154d4e769b85d49b60a73affb8fba7628e7210b0f8106d5652006d1bbba67083513e65d9

Download Submit
C:\intofont\wincommon.exe
MD5
9134637118b2a4485fb46d439133749b

SHA1
25b60dba36e432f53f68603797d50b9c6cc127ce

SHA256
5dca1a463f5308018c477503a5179f45c468245dd4a84732ee824bd704521acc

SHA512
a6db12e3349c034051940b15adbb530ba34152ccbe41afc210dad7e64331221b3dbae1563a2f3b79a43d12da54eaeac3f30cfb708ebc75ab6a9dfc30a8f1e601

Download Submit
C:\intofont\wincommon.exe
MD5
9134637118b2a4485fb46d439133749b

SHA1
25b60dba36e432f53f68603797d50b9c6cc127ce

SHA256
5dca1a463f5308018c477503a5179f45c468245dd4a84732ee824bd704521acc

SHA512
a6db12e3349c034051940b15adbb530ba34152ccbe41afc210dad7e64331221b3dbae1563a2f3b79a43d12da54eaeac3f30cfb708ebc75ab6a9dfc30a8f1e601

Download Submit
C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat
MD5
9fe442702fb57ffec2b831c3949a74e0

SHA1
e285d89241ef0aeeeb50f65e09a741baf399cb1f

SHA256
d50176a5de27bc9b4c52ebb4e30ec4cbf1e6a79eda4d83a013b220f489a5bcb9

SHA512
548a8df7f0d9278f84eca35bf40638a4572cb625050f7a0684ee14b2117df8307101d8f9383c3fcab23fcf656c21f69db3f4509a037307ed6658ff4c063b4eab

Download Submit
\intofont\wincommon.exe
MD5
9134637118b2a4485fb46d439133749b

SHA1
25b60dba36e432f53f68603797d50b9c6cc127ce

SHA256
5dca1a463f5308018c477503a5179f45c468245dd4a84732ee824bd704521acc

SHA512
a6db12e3349c034051940b15adbb530ba34152ccbe41afc210dad7e64331221b3dbae1563a2f3b79a43d12da54eaeac3f30cfb708ebc75ab6a9dfc30a8f1e601

Download Submit
memory/340-19-0x0000000000000000-mapping.dmp

Download
memory/384-8-0x0000000000000000-mapping.dmp

Download
memory/628-14-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download
memory/628-15-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/628-11-0x0000000000000000-mapping.dmp

Download
memory/900-20-0x0000000000000000-mapping.dmp

Download
memory/1292-9-0x0000000002810000-0x0000000002814000-memory.dmp

Filesize
16KB

Download
memory/1292-2-0x0000000000000000-mapping.dmp

Download
memory/1304-17-0x0000000000000000-mapping.dmp

Download
memory/1356-3-0x0000000000000000-mapping.dmp

Download
memory/1452-18-0x0000000000000000-mapping.dmp

Download
memory/1828-0-0x0000000002560000-0x0000000002661000-memory.dmp

Filesize
1.0MB

Download
memory/1856-21-0x0000000000000000-mapping.dmp

Download
memory/1856-24-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download
memory/1856-25-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download