dcrat | edd956a7bc18bf82d3716d1b7a9a485c7ed665edd53cd9459580e005e2735c17

Analysis

max time kernel
147s
max time network
145s
platform
windows10_x64
resource
win10v20201028
submitted
06/01/2021, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
453e7367b3b7afedff2e86db457362f0.exe
Size 1.0MB
Sample210106-8q1pt7bpgx
SHA256 edd956a7bc18bf82d3716d1b7a9a485c7ed665edd53cd9459580e005e2735c17
MD5 453e7367b3b7afedff2e86db457362f0
SHA1 d8f3edcaf57d8d169f540c27edba7f3cab73cb8b
SHA512 4d2b5f72736f142b4036f0a4c50b1c9ee6b771213b778ff0e1d79a9ad414e5938ba58ec66971dd18333d4dfd01e6e386db216bfb3ded647443c6bf477cc4159b
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

Contains code to disable Windows Defender 15 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/2872-46-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-45-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-48-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-47-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-49-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-50-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-51-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-52-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-53-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-54-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-55-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-56-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-58-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-59-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/2872-57-0x0000000000000000-mapping.dmp	disable_win_def

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3248 created 2872	3248	WerFault.exe	97

DC Rat Payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000100000001ab8b-28.dat	dcrat
behavioral2/files/0x000100000001ab8b-29.dat	dcrat
behavioral2/files/0x000100000001ab96-39.dat	dcrat
behavioral2/files/0x000100000001ab96-40.dat	dcrat

Executes dropped EXE 3 IoCs

pid	Process
2216	MyQL6W2jiNBvDJ2AICci.exe
2184	reviewsession.exe
2872	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3248	2872	WerFault.exe	97

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3952	schtasks.exe
2120	schtasks.exe
1992	schtasks.exe
732	schtasks.exe
2240	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	453e7367b3b7afedff2e86db457362f0.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	MyQL6W2jiNBvDJ2AICci.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2184	reviewsession.exe
2872	svchost.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe
3248	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	reviewsession.exe
Token: SeDebugPrivilege	2872	svchost.exe
Token: SeDebugPrivilege	3248	WerFault.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 3780	60	453e7367b3b7afedff2e86db457362f0.exe	76
PID 60 wrote to memory of 3780	60	453e7367b3b7afedff2e86db457362f0.exe	76
PID 60 wrote to memory of 3780	60	453e7367b3b7afedff2e86db457362f0.exe	76
PID 3780 wrote to memory of 192	3780	WScript.exe	77
PID 3780 wrote to memory of 192	3780	WScript.exe	77
PID 3780 wrote to memory of 192	3780	WScript.exe	77
PID 192 wrote to memory of 2216	192	cmd.exe	79
PID 192 wrote to memory of 2216	192	cmd.exe	79
PID 192 wrote to memory of 2216	192	cmd.exe	79
PID 2216 wrote to memory of 3456	2216	MyQL6W2jiNBvDJ2AICci.exe	80
PID 2216 wrote to memory of 3456	2216	MyQL6W2jiNBvDJ2AICci.exe	80
PID 2216 wrote to memory of 3456	2216	MyQL6W2jiNBvDJ2AICci.exe	80
PID 3456 wrote to memory of 3428	3456	WScript.exe	81
PID 3456 wrote to memory of 3428	3456	WScript.exe	81
PID 3456 wrote to memory of 3428	3456	WScript.exe	81
PID 3428 wrote to memory of 2184	3428	cmd.exe	83
PID 3428 wrote to memory of 2184	3428	cmd.exe	83
PID 2184 wrote to memory of 3952	2184	reviewsession.exe	87
PID 2184 wrote to memory of 3952	2184	reviewsession.exe	87
PID 2184 wrote to memory of 2120	2184	reviewsession.exe	89
PID 2184 wrote to memory of 2120	2184	reviewsession.exe	89
PID 2184 wrote to memory of 1992	2184	reviewsession.exe	91
PID 2184 wrote to memory of 1992	2184	reviewsession.exe	91
PID 2184 wrote to memory of 732	2184	reviewsession.exe	93
PID 2184 wrote to memory of 732	2184	reviewsession.exe	93
PID 2184 wrote to memory of 2240	2184	reviewsession.exe	95
PID 2184 wrote to memory of 2240	2184	reviewsession.exe	95
PID 2184 wrote to memory of 2872	2184	reviewsession.exe	97
PID 2184 wrote to memory of 2872	2184	reviewsession.exe	97

C:\Users\Admin\AppData\Local\Temp\453e7367b3b7afedff2e86db457362f0.exe
"C:\Users\Admin\AppData\Local\Temp\453e7367b3b7afedff2e86db457362f0.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\perfmonitor\V3NIADnvghJO7342PdyNDpwEeaPA88.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\perfmonitor\cXAUxDxuelplhGSoFPITRW0GKnKaFQ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:192
  - - C:\perfmonitor\MyQL6W2jiNBvDJ2AICci.exe
      MyQL6W2jiNBvDJ2AICci.exe -p9c9299c5645c3d82608812aacd520487889c5060
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\perfmonitor\s2wszPs6OEPLfEIEggXoi70BPyGKiA.vbe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3456
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\perfmonitor\M4XcYjrZXsCTa023NuM4onxqDRce0N.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\perfmonitor\reviewsession.exe
        
        "C:\perfmonitor\reviewsession.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:3952
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\svchost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:2120
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\ProgramData\USOPrivate\smss.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1992
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\perfmonitor\svchost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:732
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\PerfLogs\svchost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:2240
        
        C:\PerfLogs\svchost.exe
        
        "C:\PerfLogs\svchost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2872 -s 1416
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-30-0x00007FF9E6B30000-0x00007FF9E751C000-memory.dmp

Download

memory/2184-31-0x00000211B0E60000-0x00000211B0E61000-memory.dmp

Download

memory/2872-41-0x00007FF9E6B30000-0x00007FF9E751C000-memory.dmp

Download

memory/3248-44-0x0000026FEADE0000-0x0000026FEADE1000-memory.dmp

Download