dcrat | 3b20be034ea25bcf142fe6d985c38918bde59c780b3ac7bdef4f0b88048f5dd0

General

Target
728f3575ead222e4e13b9558291547be.exe
Size 1.3MB
Sample210817-xphd8vys6e
SHA256 3b20be034ea25bcf142fe6d985c38918bde59c780b3ac7bdef4f0b88048f5dd0
MD5 728f3575ead222e4e13b9558291547be
SHA1 a8cc84f01e26fa44c411784169c27425ae580b03
SHA512 3fb1fb6ba0dbe5d9b5c2681e9142894e56985e7328b544594f27b2d4b44bd873cfbeb41709dca67a3ae2fb44679d303c77cc8b126daf61e2957b8b3b9b4fa4cd
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	4264	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	4264	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	4264	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4264	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	4264	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	4264	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	4264	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	4264	schtasks.exe	74

DCRat Payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000100000001ab3f-122.dat	dcrat
behavioral2/files/0x000100000001ab3f-123.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2220	fontdrvhost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\Desktop\\fontdrvhost.exe\""	728f3575ead222e4e13b9558291547be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	728f3575ead222e4e13b9558291547be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default User\\lsass.exe\""	728f3575ead222e4e13b9558291547be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Boot\\bg-BG\\fontdrvhost.exe\""	728f3575ead222e4e13b9558291547be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\PerfLogs\\RuntimeBroker.exe\""	728f3575ead222e4e13b9558291547be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	728f3575ead222e4e13b9558291547be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\C_869\\lsass.exe\""	728f3575ead222e4e13b9558291547be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\BluetoothApis\\taskhostw.exe\""	728f3575ead222e4e13b9558291547be.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\BluetoothApis\taskhostw.exe	728f3575ead222e4e13b9558291547be.exe
File created	C:\Windows\System32\BluetoothApis\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	728f3575ead222e4e13b9558291547be.exe
File created	C:\Windows\System32\C_869\lsass.exe	728f3575ead222e4e13b9558291547be.exe
File created	C:\Windows\System32\C_869\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	728f3575ead222e4e13b9558291547be.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2432	schtasks.exe
640	schtasks.exe
756	schtasks.exe
3204	schtasks.exe
2088	schtasks.exe
4212	schtasks.exe
4176	schtasks.exe
1980	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	728f3575ead222e4e13b9558291547be.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4800	728f3575ead222e4e13b9558291547be.exe
4800	728f3575ead222e4e13b9558291547be.exe
4800	728f3575ead222e4e13b9558291547be.exe
4800	728f3575ead222e4e13b9558291547be.exe
4800	728f3575ead222e4e13b9558291547be.exe
4800	728f3575ead222e4e13b9558291547be.exe
2220	fontdrvhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	728f3575ead222e4e13b9558291547be.exe
Token: SeDebugPrivilege	2220	fontdrvhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 904	4800	728f3575ead222e4e13b9558291547be.exe	83
PID 4800 wrote to memory of 904	4800	728f3575ead222e4e13b9558291547be.exe	83
PID 904 wrote to memory of 1084	904	cmd.exe	85
PID 904 wrote to memory of 1084	904	cmd.exe	85
PID 904 wrote to memory of 1152	904	cmd.exe	86
PID 904 wrote to memory of 1152	904	cmd.exe	86
PID 904 wrote to memory of 2220	904	cmd.exe	89
PID 904 wrote to memory of 2220	904	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\728f3575ead222e4e13b9558291547be.exe
"C:\Users\Admin\AppData\Local\Temp\728f3575ead222e4e13b9558291547be.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CNCSqkbrjg.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1084
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1152
- - C:\Recovery\WindowsRE\fontdrvhost.exe
    "C:\Recovery\WindowsRE\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\C_869\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\BluetoothApis\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Boot\bg-BG\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-126-0x000000001BB50000-0x000000001BB52000-memory.dmp

Download

memory/2220-127-0x00000000015C0000-0x00000000015C7000-memory.dmp

Download

memory/2220-128-0x00000000015D0000-0x00000000015D6000-memory.dmp

Download

memory/2220-129-0x00000000015E0000-0x00000000015E3000-memory.dmp

Download

memory/2220-130-0x0000000002DA0000-0x0000000002DA5000-memory.dmp

Download

memory/2220-131-0x0000000002DB0000-0x0000000002DB7000-memory.dmp

Download

memory/2220-132-0x0000000002DC0000-0x0000000002DC2000-memory.dmp

Download

memory/2220-133-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Download

memory/4800-114-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/4800-116-0x000000001B600000-0x000000001B602000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads