dcrat | aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb

General

Target

AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Size

641KB
MD5

62137247f4c2e5f4f60543a318a4c092
SHA1

2372a8c8638272f9508f5d1a8cb4a1688b9e5fa3
SHA256

aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb
SHA512

dd531d4b6b3682c5b7b0f8ddac3ae3b8fa45468a691a09a88090296cdbb8c522c8b58d36b226a7f3104eadc94eb7a1e1e3a429a0b08775878dd1865488379dfa

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat Payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00030000000130dd-71.dat	dcrat
behavioral1/files/0x00030000000130dd-73.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
928	csrss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ipinfo.io
6	ipinfo.io

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\FXSMON\dwm.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File opened for modification	C:\Windows\System32\FXSMON\dwm.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\FXSMON\6cb0b6c459d5d3455a3da700e713f2e2529862ff	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\UI0Detect\wininit.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\UI0Detect\560854153607923c4c5f107085a7db67be01f252	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1648	schtasks.exe
1832	schtasks.exe
1268	schtasks.exe
1524	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1096	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
928	csrss.exe
928	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
928	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Token: SeDebugPrivilege	928	csrss.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1524	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	30
PID 1032 wrote to memory of 1524	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	30
PID 1032 wrote to memory of 1524	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	30
PID 1032 wrote to memory of 1648	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	32
PID 1032 wrote to memory of 1648	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	32
PID 1032 wrote to memory of 1648	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	32
PID 1032 wrote to memory of 1832	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	34
PID 1032 wrote to memory of 1832	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	34
PID 1032 wrote to memory of 1832	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	34
PID 1032 wrote to memory of 1268	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	36
PID 1032 wrote to memory of 1268	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	36
PID 1032 wrote to memory of 1268	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	36
PID 1032 wrote to memory of 748	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	38
PID 1032 wrote to memory of 748	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	38
PID 1032 wrote to memory of 748	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	38
PID 748 wrote to memory of 1252	748	cmd.exe	40
PID 748 wrote to memory of 1252	748	cmd.exe	40
PID 748 wrote to memory of 1252	748	cmd.exe	40
PID 748 wrote to memory of 1096	748	cmd.exe	41
PID 748 wrote to memory of 1096	748	cmd.exe	41
PID 748 wrote to memory of 1096	748	cmd.exe	41
PID 748 wrote to memory of 928	748	cmd.exe	42
PID 748 wrote to memory of 928	748	cmd.exe	42
PID 748 wrote to memory of 928	748	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
"C:\Users\Admin\AppData\Local\Temp\AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\FXSMON\dwm.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1524
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1648
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\UI0Detect\wininit.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1832
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\ProgramData\Microsoft\eHome\logs\csrss.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q6cIN7p7yZ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1252
- - C:\Windows\system32\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:1096
- - C:\ProgramData\Microsoft\eHome\logs\csrss.exe
    "C:\ProgramData\Microsoft\eHome\logs\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-76-0x000000001B060000-0x000000001B062000-memory.dmp

Filesize
8KB

Download
memory/928-74-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1032-60-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1032-62-0x000000001AF70000-0x000000001AF72000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads