dcrat | aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb

General

Target

AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Size

641KB
MD5

62137247f4c2e5f4f60543a318a4c092
SHA1

2372a8c8638272f9508f5d1a8cb4a1688b9e5fa3
SHA256

aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb
SHA512

dd531d4b6b3682c5b7b0f8ddac3ae3b8fa45468a691a09a88090296cdbb8c522c8b58d36b226a7f3104eadc94eb7a1e1e3a429a0b08775878dd1865488379dfa

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat Payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\ProgramData\Microsoft\eHome\logs\csrss.exe	dcrat
C:\ProgramData\Microsoft\eHome\logs\csrss.exe	dcrat

Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

928 csrss.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ipinfo.io
6 ipinfo.io

pid	process
928	csrss.exe

flow	ioc
7	ipinfo.io
6	ipinfo.io

Drops file in System32 directory 5 IoCs

Processes:

AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

description	ioc	process
File created	C:\Windows\System32\FXSMON\dwm.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File opened for modification	C:\Windows\System32\FXSMON\dwm.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\FXSMON\6cb0b6c459d5d3455a3da700e713f2e2529862ff	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\UI0Detect\wininit.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\UI0Detect\560854153607923c4c5f107085a7db67be01f252	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1648 schtasks.exe
1832 schtasks.exe
1268 schtasks.exe
1524 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1096 PING.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

AA2356A089DEA9B1884085A9C12401C149F47533851B0.execsrss.exe

pid process

1032 AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
928 csrss.exe
928 csrss.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

csrss.exe

pid process

928 csrss.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AA2356A089DEA9B1884085A9C12401C149F47533851B0.execsrss.exe

description pid process

Token: SeDebugPrivilege 1032 AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Token: SeDebugPrivilege 928 csrss.exe

pid	process
1648	schtasks.exe
1832	schtasks.exe
1268	schtasks.exe
1524	schtasks.exe

pid	process
1096	PING.EXE

pid	process
1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
928	csrss.exe
928	csrss.exe

pid	process
928	csrss.exe

description	pid	process
Token: SeDebugPrivilege	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Token: SeDebugPrivilege	928	csrss.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

AA2356A089DEA9B1884085A9C12401C149F47533851B0.execmd.exe

description	pid	process	target process
PID 1032 wrote to memory of 1524	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1524	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1524	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1648	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1648	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1648	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1832	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1832	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1832	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1268	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1268	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 1268	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 1032 wrote to memory of 748	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	cmd.exe
PID 1032 wrote to memory of 748	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	cmd.exe
PID 1032 wrote to memory of 748	1032	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	cmd.exe
PID 748 wrote to memory of 1252	748	cmd.exe	chcp.com
PID 748 wrote to memory of 1252	748	cmd.exe	chcp.com
PID 748 wrote to memory of 1252	748	cmd.exe	chcp.com
PID 748 wrote to memory of 1096	748	cmd.exe	PING.EXE
PID 748 wrote to memory of 1096	748	cmd.exe	PING.EXE
PID 748 wrote to memory of 1096	748	cmd.exe	PING.EXE
PID 748 wrote to memory of 928	748	cmd.exe	csrss.exe
PID 748 wrote to memory of 928	748	cmd.exe	csrss.exe
PID 748 wrote to memory of 928	748	cmd.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
"C:\Users\Admin\AppData\Local\Temp\AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\FXSMON\dwm.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1524
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1648
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\UI0Detect\wininit.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1832
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\ProgramData\Microsoft\eHome\logs\csrss.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q6cIN7p7yZ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1252
- - C:\Windows\system32\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:1096
- - C:\ProgramData\Microsoft\eHome\logs\csrss.exe
    "C:\ProgramData\Microsoft\eHome\logs\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\eHome\logs\csrss.exe

MD5
62137247f4c2e5f4f60543a318a4c092

SHA1
2372a8c8638272f9508f5d1a8cb4a1688b9e5fa3

SHA256
aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb

SHA512
dd531d4b6b3682c5b7b0f8ddac3ae3b8fa45468a691a09a88090296cdbb8c522c8b58d36b226a7f3104eadc94eb7a1e1e3a429a0b08775878dd1865488379dfa

Download Submit
C:\ProgramData\Microsoft\eHome\logs\csrss.exe

MD5
62137247f4c2e5f4f60543a318a4c092

SHA1
2372a8c8638272f9508f5d1a8cb4a1688b9e5fa3

SHA256
aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb

SHA512
dd531d4b6b3682c5b7b0f8ddac3ae3b8fa45468a691a09a88090296cdbb8c522c8b58d36b226a7f3104eadc94eb7a1e1e3a429a0b08775878dd1865488379dfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\q6cIN7p7yZ.bat

MD5
33a7fcb528ca2c894594ba876a511d3b

SHA1
cda888e970769dbcb6a176432d412125bddb24b9

SHA256
743ff133d1c516f9b8b971eb0b278780e0f356debaab667b97524eb85898bd71

SHA512
50b3ed59ff72465b23cc76622e1f43cee8a68ceba604896beb1a3a419397787ac3da0b6055e3bf0add0a724a8fb50d3c4eab1e5185f2db848f848fbc99705f7a

Download Submit
memory/748-67-0x0000000000000000-mapping.dmp

Download
memory/928-76-0x000000001B060000-0x000000001B062000-memory.dmp

Filesize
8KB

Download
memory/928-74-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/928-72-0x0000000000000000-mapping.dmp

Download
memory/1032-60-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1032-62-0x000000001AF70000-0x000000001AF72000-memory.dmp

Filesize
8KB

Download
memory/1096-70-0x0000000000000000-mapping.dmp

Download
memory/1252-69-0x0000000000000000-mapping.dmp

Download
memory/1268-66-0x0000000000000000-mapping.dmp

Download
memory/1524-63-0x0000000000000000-mapping.dmp

Download
memory/1648-64-0x0000000000000000-mapping.dmp

Download
memory/1832-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads