dcrat | 2f1ba0d2a1aaa17d2a8f8f9f97b9f553b1dc9e7d32039cf36382bddcebbfdaef

General

Target
560df81553f2ef8daf7019589f991c6d.exe
Size 549KB
Sample210802-9jcpaffkw2
SHA256 2f1ba0d2a1aaa17d2a8f8f9f97b9f553b1dc9e7d32039cf36382bddcebbfdaef
MD5 560df81553f2ef8daf7019589f991c6d
SHA1 a5fb46830c076f1d4742b6a25d3df613bfb7d2f5
SHA512 70fd49763c6ef90c62aa2578bbe533a86a203b3c7289d1a56b530efd6ea29ae0baf769817cc828ba7e384ed9ec7a4b61c8b2aa122be0500a54f2b576059178e3
MD5 SHA1 SHA512

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4064-128-0x0000000001870000-0x0000000001872000-memory.dmp	disable_win_def

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	3504	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	3504	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	492	3504	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	3504	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	3504	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	196	3504	schtasks.exe	15

DCRat Payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000100000001ab30-122.dat	dcrat
behavioral2/files/0x000100000001ab30-123.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
4064	sppsvc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Boot\\et-EE\\dllhost.exe\""	560df81553f2ef8daf7019589f991c6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Boot\\ro-RO\\sppsvc.exe\""	560df81553f2ef8daf7019589f991c6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\drvinst\\WmiPrvSE.exe\""	560df81553f2ef8daf7019589f991c6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\icsvc\\sihost.exe\""	560df81553f2ef8daf7019589f991c6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\notificationplatformcomponent\\dllhost.exe\""	560df81553f2ef8daf7019589f991c6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Boot\\es-ES\\System.exe\""	560df81553f2ef8daf7019589f991c6d.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\notificationplatformcomponent\dllhost.exe	560df81553f2ef8daf7019589f991c6d.exe
File opened for modification	C:\Windows\System32\notificationplatformcomponent\dllhost.exe	560df81553f2ef8daf7019589f991c6d.exe
File created	C:\Windows\System32\notificationplatformcomponent\5940a34987c99120d96dace90a3f93f329dcad63	560df81553f2ef8daf7019589f991c6d.exe
File created	C:\Windows\System32\wbem\drvinst\WmiPrvSE.exe	560df81553f2ef8daf7019589f991c6d.exe
File created	C:\Windows\System32\wbem\drvinst\24dbde2999530ef5fd907494bc374d663924116c	560df81553f2ef8daf7019589f991c6d.exe
File created	C:\Windows\System32\icsvc\sihost.exe	560df81553f2ef8daf7019589f991c6d.exe
File created	C:\Windows\System32\icsvc\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3	560df81553f2ef8daf7019589f991c6d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3548	schtasks.exe
4044	schtasks.exe
492	schtasks.exe
3148	schtasks.exe
3508	schtasks.exe
196	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	560df81553f2ef8daf7019589f991c6d.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
644	560df81553f2ef8daf7019589f991c6d.exe
644	560df81553f2ef8daf7019589f991c6d.exe
644	560df81553f2ef8daf7019589f991c6d.exe
644	560df81553f2ef8daf7019589f991c6d.exe
644	560df81553f2ef8daf7019589f991c6d.exe
644	560df81553f2ef8daf7019589f991c6d.exe
644	560df81553f2ef8daf7019589f991c6d.exe
4064	sppsvc.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	560df81553f2ef8daf7019589f991c6d.exe
Token: SeDebugPrivilege	4064	sppsvc.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeIncreaseQuotaPrivilege	4040	powershell.exe
Token: SeSecurityPrivilege	4040	powershell.exe
Token: SeTakeOwnershipPrivilege	4040	powershell.exe
Token: SeLoadDriverPrivilege	4040	powershell.exe
Token: SeSystemProfilePrivilege	4040	powershell.exe
Token: SeSystemtimePrivilege	4040	powershell.exe
Token: SeProfSingleProcessPrivilege	4040	powershell.exe
Token: SeIncBasePriorityPrivilege	4040	powershell.exe
Token: SeCreatePagefilePrivilege	4040	powershell.exe
Token: SeBackupPrivilege	4040	powershell.exe
Token: SeRestorePrivilege	4040	powershell.exe
Token: SeShutdownPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeSystemEnvironmentPrivilege	4040	powershell.exe
Token: SeRemoteShutdownPrivilege	4040	powershell.exe
Token: SeUndockPrivilege	4040	powershell.exe
Token: SeManageVolumePrivilege	4040	powershell.exe
Token: 33	4040	powershell.exe
Token: 34	4040	powershell.exe
Token: 35	4040	powershell.exe
Token: 36	4040	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2384	644	560df81553f2ef8daf7019589f991c6d.exe	81
PID 644 wrote to memory of 2384	644	560df81553f2ef8daf7019589f991c6d.exe	81
PID 2384 wrote to memory of 3048	2384	cmd.exe	83
PID 2384 wrote to memory of 3048	2384	cmd.exe	83
PID 2384 wrote to memory of 2080	2384	cmd.exe	84
PID 2384 wrote to memory of 2080	2384	cmd.exe	84
PID 2384 wrote to memory of 4064	2384	cmd.exe	87
PID 2384 wrote to memory of 4064	2384	cmd.exe	87
PID 4064 wrote to memory of 4040	4064	sppsvc.exe	88
PID 4064 wrote to memory of 4040	4064	sppsvc.exe	88

C:\Users\Admin\AppData\Local\Temp\560df81553f2ef8daf7019589f991c6d.exe
"C:\Users\Admin\AppData\Local\Temp\560df81553f2ef8daf7019589f991c6d.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rgI9ahPw6Q.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3048
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2080
- - C:\Boot\ro-RO\sppsvc.exe
    "C:\Boot\ro-RO\sppsvc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\notificationplatformcomponent\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Boot\es-ES\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Boot\et-EE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Boot\ro-RO\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\drvinst\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\icsvc\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:196