dcrat | 95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7

General

Target
95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe
Size 1.6MB
Sample210913-jm5rdsdca9
SHA256 95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7
MD5 d716e824b21be78a0e8ef5af6592cb66
SHA1 2277bf3c88daef472243b62305a8dc50614ef192
SHA512 0c14b9de9502cf7c10dc6d2539e5cbc8f22de7a956ef784dd0f7e8ec195eb9767daff3b830a9d91ca316ff83880490b4a4ef5f430fba02c1f941703e718b6763
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\xwtpdui\\sppsvc.exe\", \"C:\\Windows\\System32\\panmap\\csrss.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\xwtpdui\\sppsvc.exe\", \"C:\\Windows\\System32\\panmap\\csrss.exe\", \"C:\\Users\\Default User\\smss.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\xwtpdui\\sppsvc.exe\", \"C:\\Windows\\System32\\panmap\\csrss.exe\", \"C:\\Users\\Default User\\smss.exe\", \"C:\\Windows\\System32\\SubRange\\taskhost.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\xwtpdui\\sppsvc.exe\", \"C:\\Windows\\System32\\panmap\\csrss.exe\", \"C:\\Users\\Default User\\smss.exe\", \"C:\\Windows\\System32\\SubRange\\taskhost.exe\", \"C:\\Users\\All Users\\Start Menu\\WmiPrvSE.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\xwtpdui\\sppsvc.exe\", \"C:\\Windows\\System32\\panmap\\csrss.exe\", \"C:\\Users\\Default User\\smss.exe\", \"C:\\Windows\\System32\\SubRange\\taskhost.exe\", \"C:\\Users\\All Users\\Start Menu\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\FXSUNATD\\dwm.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\xwtpdui\\sppsvc.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	580	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	580	schtasks.exe	34

DCRat Payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000012f08-59.dat	dcrat
behavioral1/files/0x0002000000012f08-60.dat	dcrat
behavioral1/files/0x0002000000012f08-61.dat	dcrat
behavioral1/files/0x0002000000012f08-63.dat	dcrat
behavioral1/files/0x0001000000012f16-68.dat	dcrat
behavioral1/files/0x0001000000012f16-69.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
636	refruntimeBrokerhostSvcSessionperfnet.exe
2044	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
776	cmd.exe
776	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\panmap\\csrss.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\panmap\\csrss.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default User\\smss.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default User\\smss.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\SubRange\\taskhost.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\FXSUNATD\\dwm.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\xwtpdui\\sppsvc.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\xwtpdui\\sppsvc.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\SubRange\\taskhost.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\All Users\\Start Menu\\WmiPrvSE.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\All Users\\Start Menu\\WmiPrvSE.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\FXSUNATD\\dwm.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\FXSUNATD\6cb0b6c459d5d3455a3da700e713f2e2529862ff	refruntimeBrokerhostSvcSessionperfnet.exe
File opened for modification	C:\Windows\System32\xwtpdui\sppsvc.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\SubRange\b75386f1303e64d8139363b71e44ac16341adf4e	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\panmap\csrss.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\panmap\886983d96e3d3e31032c679b2d4ea91b6c05afef	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\SubRange\taskhost.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\FXSUNATD\dwm.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\xwtpdui\sppsvc.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\xwtpdui\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	refruntimeBrokerhostSvcSessionperfnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
704	schtasks.exe
1084	schtasks.exe
1324	schtasks.exe
1080	schtasks.exe
1700	schtasks.exe
1728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
636	refruntimeBrokerhostSvcSessionperfnet.exe
636	refruntimeBrokerhostSvcSessionperfnet.exe
636	refruntimeBrokerhostSvcSessionperfnet.exe
2044	smss.exe
2044	smss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	636	refruntimeBrokerhostSvcSessionperfnet.exe
Token: SeDebugPrivilege	2044	smss.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 1752	820	95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe	26
PID 820 wrote to memory of 1752	820	95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe	26
PID 820 wrote to memory of 1752	820	95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe	26
PID 820 wrote to memory of 1752	820	95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe	26
PID 1752 wrote to memory of 776	1752	WScript.exe	31
PID 1752 wrote to memory of 776	1752	WScript.exe	31
PID 1752 wrote to memory of 776	1752	WScript.exe	31
PID 1752 wrote to memory of 776	1752	WScript.exe	31
PID 776 wrote to memory of 636	776	cmd.exe	33
PID 776 wrote to memory of 636	776	cmd.exe	33
PID 776 wrote to memory of 636	776	cmd.exe	33
PID 776 wrote to memory of 636	776	cmd.exe	33
PID 636 wrote to memory of 2044	636	refruntimeBrokerhostSvcSessionperfnet.exe	41
PID 636 wrote to memory of 2044	636	refruntimeBrokerhostSvcSessionperfnet.exe	41
PID 636 wrote to memory of 2044	636	refruntimeBrokerhostSvcSessionperfnet.exe	41

C:\Users\Admin\AppData\Local\Temp\95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe
"C:\Users\Admin\AppData\Local\Temp\95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\refruntimeBrokerhostSvc\4iPK2TsM.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\refruntimeBrokerhostSvc\KipPUr0.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:776
  - - C:\refruntimeBrokerhostSvc\refruntimeBrokerhostSvcSessionperfnet.exe
      "C:\refruntimeBrokerhostSvc\refruntimeBrokerhostSvcSessionperfnet.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Users\Default User\smss.exe
        
        "C:\Users\Default User\smss.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\xwtpdui\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\panmap\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\SubRange\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\FXSUNATD\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728