dcrat | 8d7228ae5c573a10f0e86fc84ca9c5d6e1894428af1b582fdb54f6caf446bf3c

General

Target
14ed33454f45e78f6d0301bda0a2550c.exe
Size 1.3MB
Sample210911-snf9vsbeb2
SHA256 8d7228ae5c573a10f0e86fc84ca9c5d6e1894428af1b582fdb54f6caf446bf3c
MD5 14ed33454f45e78f6d0301bda0a2550c
SHA1 370ca36fde131b18ce7ca807894069352bccd90a
SHA512 0b70c83ecb7906352c791f73c18893ac582ca7593262f9cf4bf29e2349006caab6c0d4fb2db34fb8f84f08b9245ce159cec36ef54202cc6f339c48495552b2b8
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	1948	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1948	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	1948	schtasks.exe	29

DCRat Payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00040000000130de-64.dat	dcrat
behavioral1/files/0x00040000000130de-65.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1700	wininit.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\msprivs\\wininit.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\msoeacct\\winlogon.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\ProgramData\\Adobe\\Acrobat\\9.0\\Replicate\\Security\\audiodg.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ipinfo.io
10	ipinfo.io

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\msprivs\wininit.exe	14ed33454f45e78f6d0301bda0a2550c.exe
File opened for modification	C:\Windows\System32\msprivs\wininit.exe	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\msprivs\560854153607923c4c5f107085a7db67be01f252	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\msoeacct\winlogon.exe	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\msoeacct\cc11b995f2a76da408ea6a601e682e64743153ad	14ed33454f45e78f6d0301bda0a2550c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1476	schtasks.exe
1364	schtasks.exe
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1080	14ed33454f45e78f6d0301bda0a2550c.exe
1700	wininit.exe
1700	wininit.exe
1700	wininit.exe
1700	wininit.exe
1700	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1700	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	14ed33454f45e78f6d0301bda0a2550c.exe
Token: SeDebugPrivilege	1700	wininit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1700	1080	14ed33454f45e78f6d0301bda0a2550c.exe	33
PID 1080 wrote to memory of 1700	1080	14ed33454f45e78f6d0301bda0a2550c.exe	33
PID 1080 wrote to memory of 1700	1080	14ed33454f45e78f6d0301bda0a2550c.exe	33

C:\Users\Admin\AppData\Local\Temp\14ed33454f45e78f6d0301bda0a2550c.exe
"C:\Users\Admin\AppData\Local\Temp\14ed33454f45e78f6d0301bda0a2550c.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\msprivs\wininit.exe
  "C:\Windows\System32\msprivs\wininit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\msprivs\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\msoeacct\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628