dcrat | 8d7228ae5c573a10f0e86fc84ca9c5d6e1894428af1b582fdb54f6caf446bf3c

General

Target
14ed33454f45e78f6d0301bda0a2550c.exe
Size 1.3MB
Sample210911-snf9vsbeb2
SHA256 8d7228ae5c573a10f0e86fc84ca9c5d6e1894428af1b582fdb54f6caf446bf3c
MD5 14ed33454f45e78f6d0301bda0a2550c
SHA1 370ca36fde131b18ce7ca807894069352bccd90a
SHA512 0b70c83ecb7906352c791f73c18893ac582ca7593262f9cf4bf29e2349006caab6c0d4fb2db34fb8f84f08b9245ce159cec36ef54202cc6f339c48495552b2b8
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	3308	schtasks.exe	14
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	3308	schtasks.exe	14
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	3308	schtasks.exe	14
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	3308	schtasks.exe	14
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	3308	schtasks.exe	14
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	3308	schtasks.exe	14
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	3308	schtasks.exe	14
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	3308	schtasks.exe	14

DCRat Payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000400000001aaf4-123.dat	dcrat
behavioral2/files/0x000400000001aaf4-124.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3984	spoolsv.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\officecsp\\lsass.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchUI = "\"C:\\Windows\\appcompat\\Programs\\SearchUI.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\NotificationObjFactory\\sihost.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\14ed33454f45e78f6d0301bda0a2550c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredistMSI6CB3\\14ed33454f45e78f6d0301bda0a2550c.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Windows\\System32\\auditcse\\audiodg.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Boot\\it-IT\\csrss.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\WMNetMgr\\dllhost.exe\""	14ed33454f45e78f6d0301bda0a2550c.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ipinfo.io
9	ipinfo.io

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\auditcse\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\WMNetMgr\dllhost.exe	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\WMNetMgr\5940a34987c99120d96dace90a3f93f329dcad63	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\officecsp\lsass.exe	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\officecsp\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\NotificationObjFactory\sihost.exe	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\NotificationObjFactory\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\System32\auditcse\audiodg.exe	14ed33454f45e78f6d0301bda0a2550c.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\appcompat\Programs\SearchUI.exe	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\appcompat\Programs\dab4d89cac03ec27dbe47b361df763dc3f848f6c	14ed33454f45e78f6d0301bda0a2550c.exe
File created	C:\Windows\appcompat\Programs\SearchUI.exe	14ed33454f45e78f6d0301bda0a2550c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3320	schtasks.exe
4064	schtasks.exe
1668	schtasks.exe
3860	schtasks.exe
3720	schtasks.exe
3944	schtasks.exe
2652	schtasks.exe
2348	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings	14ed33454f45e78f6d0301bda0a2550c.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4000	14ed33454f45e78f6d0301bda0a2550c.exe
3984	spoolsv.exe
3984	spoolsv.exe
3984	spoolsv.exe
3984	spoolsv.exe
3984	spoolsv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3984	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4000	14ed33454f45e78f6d0301bda0a2550c.exe
Token: SeDebugPrivilege	3984	spoolsv.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 432	4000	14ed33454f45e78f6d0301bda0a2550c.exe	77
PID 4000 wrote to memory of 432	4000	14ed33454f45e78f6d0301bda0a2550c.exe	77
PID 432 wrote to memory of 2652	432	cmd.exe	79
PID 432 wrote to memory of 2652	432	cmd.exe	79
PID 432 wrote to memory of 4052	432	cmd.exe	80
PID 432 wrote to memory of 4052	432	cmd.exe	80
PID 432 wrote to memory of 3984	432	cmd.exe	81
PID 432 wrote to memory of 3984	432	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\14ed33454f45e78f6d0301bda0a2550c.exe
"C:\Users\Admin\AppData\Local\Temp\14ed33454f45e78f6d0301bda0a2550c.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p9z6VIML2q.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2652
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4052
- - C:\Recovery\WindowsRE\spoolsv.exe
    "C:\Recovery\WindowsRE\spoolsv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Windows\appcompat\Programs\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\NotificationObjFactory\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "14ed33454f45e78f6d0301bda0a2550c" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI6CB3\14ed33454f45e78f6d0301bda0a2550c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\System32\auditcse\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Boot\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\WMNetMgr\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\officecsp\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3860