dcrat | 1bf6d14c4b5f59aa30882f4aa25e9e9d703dac905a785fe020ff667600e5fc97

Analysis

max time kernel
286s
max time network
298s
platform
windows10_x64
resource
win10v20201028
submitted
18-11-2020 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ForceOp 2.8.7 - By RaiSence.exe

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3508 created 3812 3508 WerFault.exe wininit.exe
Executes dropped EXE 2 IoCs

Processes:

wincommon.exewininit.exe

pid process

1336 wincommon.exe
3812 wininit.exe

description	pid	process	target process
PID 3508 created 3812	3508	WerFault.exe	wininit.exe

Drops file in Windows directory 5 IoCs

Processes:

wincommon.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\authman\f4d236fdec2fd03914189c3b26e5cb0dfea9d761	wincommon.exe
File created	C:\Windows\InputMethod\CHT\svchost.exe	wincommon.exe
File created	C:\Windows\InputMethod\CHT\f4d236fdec2fd03914189c3b26e5cb0dfea9d761	wincommon.exe
File created	C:\Windows\Microsoft.NET\authman\svchost.exe	wincommon.exe
File opened for modification	C:\Windows\Microsoft.NET\authman\svchost.exe	wincommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3508 3812 WerFault.exe wininit.exe
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2168 schtasks.exe
3588 schtasks.exe
2436 schtasks.exe
Modifies registry class 1 IoCs

Processes:

ForceOp 2.8.7 - By RaiSence.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings ForceOp 2.8.7 - By RaiSence.exe

pid	pid_target	process	target process
3508	3812	WerFault.exe	wininit.exe

pid	process
2168	schtasks.exe
3588	schtasks.exe
2436	schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	ForceOp 2.8.7 - By RaiSence.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

wincommon.exewininit.exeWerFault.exe

pid	process
1336	wincommon.exe
3812	wininit.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe
3508	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wincommon.exewininit.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1336 wincommon.exe
Token: SeDebugPrivilege 3812 wininit.exe
Token: SeDebugPrivilege 3508 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1336	wincommon.exe
Token: SeDebugPrivilege	3812	wininit.exe
Token: SeDebugPrivilege	3508	WerFault.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

ForceOp 2.8.7 - By RaiSence.exeWScript.execmd.exewincommon.exe

description	pid	process	target process
PID 728 wrote to memory of 3768	728	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 728 wrote to memory of 3768	728	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 728 wrote to memory of 3768	728	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 728 wrote to memory of 2836	728	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 728 wrote to memory of 2836	728	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 728 wrote to memory of 2836	728	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 3768 wrote to memory of 648	3768	WScript.exe	cmd.exe
PID 3768 wrote to memory of 648	3768	WScript.exe	cmd.exe
PID 3768 wrote to memory of 648	3768	WScript.exe	cmd.exe
PID 648 wrote to memory of 1336	648	cmd.exe	wincommon.exe
PID 648 wrote to memory of 1336	648	cmd.exe	wincommon.exe
PID 1336 wrote to memory of 2168	1336	wincommon.exe	schtasks.exe
PID 1336 wrote to memory of 2168	1336	wincommon.exe	schtasks.exe
PID 1336 wrote to memory of 3588	1336	wincommon.exe	schtasks.exe
PID 1336 wrote to memory of 3588	1336	wincommon.exe	schtasks.exe
PID 1336 wrote to memory of 2436	1336	wincommon.exe	schtasks.exe
PID 1336 wrote to memory of 2436	1336	wincommon.exe	schtasks.exe
PID 1336 wrote to memory of 3812	1336	wincommon.exe	wininit.exe
PID 1336 wrote to memory of 3812	1336	wincommon.exe	wininit.exe

C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe
"C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:728

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\intofont\wincommon.exe
"C:\intofont\wincommon.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\authman\svchost.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:2168

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHT\svchost.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:3588

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\intofont\wininit.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:2436

C:\intofont\wininit.exe
"C:\intofont\wininit.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3812 -s 1824
6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\intofont\msg.vbs"
2⤵
PID:2836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe

Download Submit
C:\intofont\MOS

Download Submit
C:\intofont\msg.vbs

Download Submit
C:\intofont\wincommon.exe

Download Submit
C:\intofont\wincommon.exe

Download Submit
C:\intofont\wininit.exe

Download Submit
C:\intofont\wininit.exe

Download Submit
C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat

Download Submit
memory/648-20-0x0000000000000000-mapping.dmp

Download
memory/1336-21-0x0000000000000000-mapping.dmp

Download
memory/1336-24-0x00007FF99FA40000-0x00007FF9A042C000-memory.dmp

Filesize
9.9MB

Download
memory/1336-25-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/1336-27-0x0000000001450000-0x0000000001451000-memory.dmp

Filesize
4KB

Download
memory/2168-28-0x0000000000000000-mapping.dmp

Download
memory/2436-30-0x0000000000000000-mapping.dmp

Download
memory/2836-15-0x0000000000000000-mapping.dmp

Download
memory/3508-38-0x0000013AA2AB0000-0x0000013AA2AB1000-memory.dmp

Filesize
4KB

Download
memory/3508-57-0x0000013AA3820000-0x0000013AA3821000-memory.dmp

Filesize
4KB

Download
memory/3508-58-0x0000013AA3820000-0x0000013AA3821000-memory.dmp

Filesize
4KB

Download
memory/3508-39-0x0000013AA2AB0000-0x0000013AA2AB1000-memory.dmp

Filesize
4KB

Download
memory/3588-29-0x0000000000000000-mapping.dmp

Download
memory/3768-2-0x0000000000000000-mapping.dmp

Download
memory/3812-45-0x0000000000000000-mapping.dmp

Download
memory/3812-50-0x0000000000000000-mapping.dmp

Download
memory/3812-44-0x0000000000000000-mapping.dmp

Download
memory/3812-43-0x0000000000000000-mapping.dmp

Download
memory/3812-46-0x0000000000000000-mapping.dmp

Download
memory/3812-31-0x0000000000000000-mapping.dmp

Download
memory/3812-47-0x0000000000000000-mapping.dmp

Download
memory/3812-48-0x0000000000000000-mapping.dmp

Download
memory/3812-49-0x0000000000000000-mapping.dmp

Download
memory/3812-41-0x0000000000000000-mapping.dmp

Download
memory/3812-52-0x0000000000000000-mapping.dmp

Download
memory/3812-54-0x0000000000000000-mapping.dmp

Download
memory/3812-55-0x0000000000000000-mapping.dmp

Download
memory/3812-56-0x0000000000000000-mapping.dmp

Download
memory/3812-53-0x0000000000000000-mapping.dmp

Download
memory/3812-51-0x0000000000000000-mapping.dmp

Download
memory/3812-42-0x0000000000000000-mapping.dmp

Download
memory/3812-34-0x00007FF99FA40000-0x00007FF9A042C000-memory.dmp

Filesize
9.9MB

Download