dcrat | aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb

General

Target

AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Size

641KB
MD5

62137247f4c2e5f4f60543a318a4c092
SHA1

2372a8c8638272f9508f5d1a8cb4a1688b9e5fa3
SHA256

aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb
SHA512

dd531d4b6b3682c5b7b0f8ddac3ae3b8fa45468a691a09a88090296cdbb8c522c8b58d36b226a7f3104eadc94eb7a1e1e3a429a0b08775878dd1865488379dfa

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat Payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Windows\System32\Windows.UI.Shell\winlogon.exe	dcrat
C:\Windows\System32\Windows.UI.Shell\winlogon.exe	dcrat

Executes dropped EXE 1 IoCs

Processes:

winlogon.exe

pid process

2004 winlogon.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ipinfo.io
14 ipinfo.io

pid	process
2004	winlogon.exe

flow	ioc
15	ipinfo.io
14	ipinfo.io

Drops file in System32 directory 16 IoCs

Processes:

winlogon.exeAA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

description	ioc	process
File created	C:\Windows\System32\Windows.UI.Shell\v65NgynF79	winlogon.exe
File created	C:\Windows\System32\Windows.UI.Shell\XubydcLyQ0	winlogon.exe
File created	C:\Windows\System32\Windows.UI.Shell\winlogon.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\sqmapi\e1ef82546f0b02b7e974f28047f3788b1128cce1	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\wbem\WPDShServiceObj\WmiPrvSE.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\Windows.UI.Shell\cc11b995f2a76da408ea6a601e682e64743153ad	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File opened for modification	C:\Windows\System32\Windows.UI.Shell\v65NgynF79	winlogon.exe
File created	C:\Windows\System32\MapControlStringsRes\spoolsv.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File opened for modification	C:\Windows\System32\C_20278\winlogon.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\MapControlStringsRes\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\wbem\WPDShServiceObj\24dbde2999530ef5fd907494bc374d663924116c	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\Windows.UI.Shell\JXAxUrIXgi	winlogon.exe
File created	C:\Windows\System32\Windows.UI.Shell\pyIQbvZPVH	winlogon.exe
File created	C:\Windows\System32\C_20278\winlogon.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\sqmapi\SppExtComObj.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\C_20278\cc11b995f2a76da408ea6a601e682e64743153ad	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

Drops file in Windows directory 2 IoCs

Processes:

AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

description	ioc	process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\ec9bcefb68c5a44ec547660d5ba247f1\winlogon.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\ec9bcefb68c5a44ec547660d5ba247f1\cc11b995f2a76da408ea6a601e682e64743153ad	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

3696 schtasks.exe
2668 schtasks.exe
3704 schtasks.exe
2424 schtasks.exe
2124 schtasks.exe
1412 schtasks.exe
192 schtasks.exe
2360 schtasks.exe

pid	process
3696	schtasks.exe
2668	schtasks.exe
3704	schtasks.exe
2424	schtasks.exe
2124	schtasks.exe
1412	schtasks.exe
192	schtasks.exe
2360	schtasks.exe

Modifies registry class 1 IoCs

Processes:

AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1556 PING.EXE

pid	process
1556	PING.EXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

AA2356A089DEA9B1884085A9C12401C149F47533851B0.exewinlogon.exe

pid	process
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
2004	winlogon.exe
2004	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

winlogon.exe

pid process

2004 winlogon.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AA2356A089DEA9B1884085A9C12401C149F47533851B0.exewinlogon.exe

description pid process

Token: SeDebugPrivilege 3892 AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Token: SeDebugPrivilege 2004 winlogon.exe

pid	process
2004	winlogon.exe

description	pid	process
Token: SeDebugPrivilege	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Token: SeDebugPrivilege	2004	winlogon.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

AA2356A089DEA9B1884085A9C12401C149F47533851B0.execmd.exe

description	pid	process	target process
PID 3892 wrote to memory of 192	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 192	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 2360	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 2360	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 3696	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 3696	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 2668	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 2668	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 3704	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 3704	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 2424	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 2424	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 2124	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 2124	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 1412	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 1412	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	schtasks.exe
PID 3892 wrote to memory of 2328	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	cmd.exe
PID 3892 wrote to memory of 2328	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	cmd.exe
PID 2328 wrote to memory of 3524	2328	cmd.exe	chcp.com
PID 2328 wrote to memory of 3524	2328	cmd.exe	chcp.com
PID 2328 wrote to memory of 1556	2328	cmd.exe	PING.EXE
PID 2328 wrote to memory of 1556	2328	cmd.exe	PING.EXE
PID 2328 wrote to memory of 2004	2328	cmd.exe	winlogon.exe
PID 2328 wrote to memory of 2004	2328	cmd.exe	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
"C:\Users\Admin\AppData\Local\Temp\AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\C_20278\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:192
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\MapControlStringsRes\spoolsv.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2360
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3696
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\sqmapi\SppExtComObj.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2668
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\ec9bcefb68c5a44ec547660d5ba247f1\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3704
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WPDShServiceObj\WmiPrvSE.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2424
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\ProgramData\Application Data\dllhost.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2124
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\Windows.UI.Shell\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TZxjTu5fpb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3524
- - C:\Windows\system32\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:1556
- - C:\Windows\System32\Windows.UI.Shell\winlogon.exe
    "C:\Windows\System32\Windows.UI.Shell\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TZxjTu5fpb.bat

MD5
c9013131d6efe272ad81ca8465982068

SHA1
e3591db1a7cbdc6a7ecf63226779f1d5f019f3b5

SHA256
69e0a5099ae58639cfb86f9d083ca47323d3b86821bfa0497db58aba98c7cde4

SHA512
93bd0d8c654e8eca50d1abab9c7fab7833ea808ab743f6ffd4848d70fff8c9b7cac29808f5caf8c55c7511e38d06a2e3f5a17b44fa2f632a7fc662a9afb22e70

Download Submit
C:\Windows\System32\Windows.UI.Shell\winlogon.exe

MD5
62137247f4c2e5f4f60543a318a4c092

SHA1
2372a8c8638272f9508f5d1a8cb4a1688b9e5fa3

SHA256
aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb

SHA512
dd531d4b6b3682c5b7b0f8ddac3ae3b8fa45468a691a09a88090296cdbb8c522c8b58d36b226a7f3104eadc94eb7a1e1e3a429a0b08775878dd1865488379dfa

Download Submit
C:\Windows\System32\Windows.UI.Shell\winlogon.exe

MD5
62137247f4c2e5f4f60543a318a4c092

SHA1
2372a8c8638272f9508f5d1a8cb4a1688b9e5fa3

SHA256
aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb

SHA512
dd531d4b6b3682c5b7b0f8ddac3ae3b8fa45468a691a09a88090296cdbb8c522c8b58d36b226a7f3104eadc94eb7a1e1e3a429a0b08775878dd1865488379dfa

Download Submit
memory/192-117-0x0000000000000000-mapping.dmp

Download
memory/1412-124-0x0000000000000000-mapping.dmp

Download
memory/1556-128-0x0000000000000000-mapping.dmp

Download
memory/2004-134-0x000001CD3F620000-0x000001CD3F622000-memory.dmp

Filesize
8KB

Download
memory/2004-129-0x0000000000000000-mapping.dmp

Download
memory/2004-135-0x000001CD26D80000-0x000001CD26D81000-memory.dmp

Filesize
4KB

Download
memory/2124-123-0x0000000000000000-mapping.dmp

Download
memory/2328-125-0x0000000000000000-mapping.dmp

Download
memory/2360-118-0x0000000000000000-mapping.dmp

Download
memory/2424-122-0x0000000000000000-mapping.dmp

Download
memory/2668-120-0x0000000000000000-mapping.dmp

Download
memory/3524-127-0x0000000000000000-mapping.dmp

Download
memory/3696-119-0x0000000000000000-mapping.dmp

Download
memory/3704-121-0x0000000000000000-mapping.dmp

Download
memory/3892-114-0x000001DC84560000-0x000001DC84561000-memory.dmp

Filesize
4KB

Download
memory/3892-116-0x000001DC9EB40000-0x000001DC9EB42000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads