dcrat | cef243d8fa4ef4cb108c2cabbf0a3b17dd02aea213776351720612dc69669e68

General

Target
5adfa600_FOCzXIBcJD.exe
Size 1.4MB
Sample210818-4dy69w15k6
SHA256 cef243d8fa4ef4cb108c2cabbf0a3b17dd02aea213776351720612dc69669e68
MD5 5adfa60026465144e6410fab3f714d2e
SHA1 daa4b6471384b111da3d580f9c41ceabed9dbd15
SHA512 2589ca8deda6fd755bca15dca36339e9d56c9fab18145f3632e440eeaba14f0e400e9f18bf6a0f8471eef76ce98759af9d85c11c1bfce09cf8c50a277406ca19
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	3468	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	3468	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	3468	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	3468	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	3468	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	3468	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	3468	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	3468	schtasks.exe	20

DCRat Payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000100000001ab57-121.dat	dcrat
behavioral2/files/0x000100000001ab57-122.dat	dcrat
behavioral2/files/0x000100000001ab62-131.dat	dcrat
behavioral2/files/0x000100000001ab62-132.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
3180	reviewDriverCrtFontcrtnet.exe
1012	dllhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Defender\\Offline\\dllhost.exe\""	reviewDriverCrtFontcrtnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\reviewDriverCrt\\OfficeClickToRun.exe\""	reviewDriverCrtFontcrtnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\PerfLogs\\csrss.exe\""	reviewDriverCrtFontcrtnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\pcaui\\dllhost.exe\""	reviewDriverCrtFontcrtnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Boot\\nb-NO\\conhost.exe\""	reviewDriverCrtFontcrtnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\tetheringservice\\RuntimeBroker.exe\""	reviewDriverCrtFontcrtnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\sihost\\SppExtComObj.exe\""	reviewDriverCrtFontcrtnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources\\ShellExperienceHost.exe\""	reviewDriverCrtFontcrtnet.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\sihost\SppExtComObj.exe	reviewDriverCrtFontcrtnet.exe
File created	C:\Windows\System32\sihost\e1ef82546f0b02b7e974f28047f3788b1128cce1	reviewDriverCrtFontcrtnet.exe
File created	C:\Windows\System32\pcaui\dllhost.exe	reviewDriverCrtFontcrtnet.exe
File created	C:\Windows\System32\pcaui\5940a34987c99120d96dace90a3f93f329dcad63	reviewDriverCrtFontcrtnet.exe
File created	C:\Windows\System32\tetheringservice\RuntimeBroker.exe	reviewDriverCrtFontcrtnet.exe
File opened for modification	C:\Windows\System32\tetheringservice\RuntimeBroker.exe	reviewDriverCrtFontcrtnet.exe
File created	C:\Windows\System32\tetheringservice\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	reviewDriverCrtFontcrtnet.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\Offline\dllhost.exe	reviewDriverCrtFontcrtnet.exe
File created	C:\Program Files\Windows Defender\Offline\5940a34987c99120d96dace90a3f93f329dcad63	reviewDriverCrtFontcrtnet.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\resources\ShellExperienceHost.exe	reviewDriverCrtFontcrtnet.exe
File created	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\resources\f8c8f1285d826bc63910aaf97db97186ba642b4f	reviewDriverCrtFontcrtnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3752	schtasks.exe
2836	schtasks.exe
672	schtasks.exe
2260	schtasks.exe
3848	schtasks.exe
2868	schtasks.exe
4056	schtasks.exe
1856	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	5adfa600_FOCzXIBcJD.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	reviewDriverCrtFontcrtnet.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3180	reviewDriverCrtFontcrtnet.exe
1012	dllhost.exe
1012	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1012	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	reviewDriverCrtFontcrtnet.exe
Token: SeDebugPrivilege	1012	dllhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 4024	672	5adfa600_FOCzXIBcJD.exe	75
PID 672 wrote to memory of 4024	672	5adfa600_FOCzXIBcJD.exe	75
PID 672 wrote to memory of 4024	672	5adfa600_FOCzXIBcJD.exe	75
PID 4024 wrote to memory of 2172	4024	WScript.exe	79
PID 4024 wrote to memory of 2172	4024	WScript.exe	79
PID 4024 wrote to memory of 2172	4024	WScript.exe	79
PID 2172 wrote to memory of 3180	2172	cmd.exe	81
PID 2172 wrote to memory of 3180	2172	cmd.exe	81
PID 3180 wrote to memory of 2300	3180	reviewDriverCrtFontcrtnet.exe	90
PID 3180 wrote to memory of 2300	3180	reviewDriverCrtFontcrtnet.exe	90
PID 2300 wrote to memory of 4084	2300	cmd.exe	92
PID 2300 wrote to memory of 4084	2300	cmd.exe	92
PID 2300 wrote to memory of 3940	2300	cmd.exe	93
PID 2300 wrote to memory of 3940	2300	cmd.exe	93
PID 2300 wrote to memory of 1012	2300	cmd.exe	94
PID 2300 wrote to memory of 1012	2300	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\5adfa600_FOCzXIBcJD.exe
"C:\Users\Admin\AppData\Local\Temp\5adfa600_FOCzXIBcJD.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\reviewDriverCrt\GqZ4Z.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\reviewDriverCrt\pFx5CwZioohZPln3.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\reviewDriverCrt\reviewDriverCrtFontcrtnet.exe
      "C:\reviewDriverCrt\reviewDriverCrtFontcrtnet.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\217TTGkdJh.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2300
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4084
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3940
      - C:\Program Files\Windows Defender\Offline\dllhost.exe
        
        "C:\Program Files\Windows Defender\Offline\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\tetheringservice\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\sihost\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\resources\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\reviewDriverCrt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\PerfLogs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\pcaui\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Boot\nb-NO\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672