dcrat | aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb

General

Target

AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Size

641KB
MD5

62137247f4c2e5f4f60543a318a4c092
SHA1

2372a8c8638272f9508f5d1a8cb4a1688b9e5fa3
SHA256

aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb
SHA512

dd531d4b6b3682c5b7b0f8ddac3ae3b8fa45468a691a09a88090296cdbb8c522c8b58d36b226a7f3104eadc94eb7a1e1e3a429a0b08775878dd1865488379dfa

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat Payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000100000001ab76-130.dat	dcrat
behavioral2/files/0x000100000001ab76-131.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2004	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
14	ipinfo.io

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\Windows.UI.Shell\v65NgynF79	winlogon.exe
File created	C:\Windows\System32\Windows.UI.Shell\XubydcLyQ0	winlogon.exe
File created	C:\Windows\System32\Windows.UI.Shell\winlogon.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\sqmapi\e1ef82546f0b02b7e974f28047f3788b1128cce1	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\wbem\WPDShServiceObj\WmiPrvSE.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\Windows.UI.Shell\cc11b995f2a76da408ea6a601e682e64743153ad	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File opened for modification	C:\Windows\System32\Windows.UI.Shell\v65NgynF79	winlogon.exe
File created	C:\Windows\System32\MapControlStringsRes\spoolsv.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File opened for modification	C:\Windows\System32\C_20278\winlogon.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\MapControlStringsRes\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\wbem\WPDShServiceObj\24dbde2999530ef5fd907494bc374d663924116c	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\Windows.UI.Shell\JXAxUrIXgi	winlogon.exe
File created	C:\Windows\System32\Windows.UI.Shell\pyIQbvZPVH	winlogon.exe
File created	C:\Windows\System32\C_20278\winlogon.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\sqmapi\SppExtComObj.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\System32\C_20278\cc11b995f2a76da408ea6a601e682e64743153ad	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\ec9bcefb68c5a44ec547660d5ba247f1\winlogon.exe	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\ec9bcefb68c5a44ec547660d5ba247f1\cc11b995f2a76da408ea6a601e682e64743153ad	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3696	schtasks.exe
2668	schtasks.exe
3704	schtasks.exe
2424	schtasks.exe
2124	schtasks.exe
1412	schtasks.exe
192	schtasks.exe
2360	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1556	PING.EXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
2004	winlogon.exe
2004	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2004	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
Token: SeDebugPrivilege	2004	winlogon.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 192	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	79
PID 3892 wrote to memory of 192	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	79
PID 3892 wrote to memory of 2360	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	81
PID 3892 wrote to memory of 2360	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	81
PID 3892 wrote to memory of 3696	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	83
PID 3892 wrote to memory of 3696	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	83
PID 3892 wrote to memory of 2668	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	85
PID 3892 wrote to memory of 2668	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	85
PID 3892 wrote to memory of 3704	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	87
PID 3892 wrote to memory of 3704	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	87
PID 3892 wrote to memory of 2424	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	89
PID 3892 wrote to memory of 2424	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	89
PID 3892 wrote to memory of 2124	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	91
PID 3892 wrote to memory of 2124	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	91
PID 3892 wrote to memory of 1412	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	93
PID 3892 wrote to memory of 1412	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	93
PID 3892 wrote to memory of 2328	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	95
PID 3892 wrote to memory of 2328	3892	AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe	95
PID 2328 wrote to memory of 3524	2328	cmd.exe	97
PID 2328 wrote to memory of 3524	2328	cmd.exe	97
PID 2328 wrote to memory of 1556	2328	cmd.exe	98
PID 2328 wrote to memory of 1556	2328	cmd.exe	98
PID 2328 wrote to memory of 2004	2328	cmd.exe	99
PID 2328 wrote to memory of 2004	2328	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe
"C:\Users\Admin\AppData\Local\Temp\AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\C_20278\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:192
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\MapControlStringsRes\spoolsv.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2360
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3696
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\sqmapi\SppExtComObj.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2668
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\ec9bcefb68c5a44ec547660d5ba247f1\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3704
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WPDShServiceObj\WmiPrvSE.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2424
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\ProgramData\Application Data\dllhost.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2124
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\Windows.UI.Shell\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TZxjTu5fpb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3524
- - C:\Windows\system32\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:1556
- - C:\Windows\System32\Windows.UI.Shell\winlogon.exe
    "C:\Windows\System32\Windows.UI.Shell\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-134-0x000001CD3F620000-0x000001CD3F622000-memory.dmp

Filesize
8KB

Download
memory/2004-135-0x000001CD26D80000-0x000001CD26D81000-memory.dmp

Filesize
4KB

Download
memory/3892-114-0x000001DC84560000-0x000001DC84561000-memory.dmp

Filesize
4KB

Download
memory/3892-116-0x000001DC9EB40000-0x000001DC9EB42000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads