dcrat | 95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7

General

Target
95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe
Size 1.6MB
Sample210913-jm5rdsdca9
SHA256 95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7
MD5 d716e824b21be78a0e8ef5af6592cb66
SHA1 2277bf3c88daef472243b62305a8dc50614ef192
SHA512 0c14b9de9502cf7c10dc6d2539e5cbc8f22de7a956ef784dd0f7e8ec195eb9767daff3b830a9d91ca316ff83880490b4a4ef5f430fba02c1f941703e718b6763
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\services.exe\", \"C:\\Windows\\System32\\sppinst\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\services.exe\", \"C:\\Windows\\System32\\sppinst\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources\\ShellExperienceHost.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\services.exe\", \"C:\\Windows\\System32\\sppinst\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources\\ShellExperienceHost.exe\", \"C:\\refruntimeBrokerhostSvc\\Idle.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\services.exe\", \"C:\\Windows\\System32\\sppinst\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources\\ShellExperienceHost.exe\", \"C:\\refruntimeBrokerhostSvc\\Idle.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\taskhostw.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\services.exe\", \"C:\\Windows\\System32\\sppinst\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources\\ShellExperienceHost.exe\", \"C:\\refruntimeBrokerhostSvc\\Idle.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\taskhostw.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.it-it\\OfficeClickToRun.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\services.exe\", \"C:\\Windows\\System32\\sppinst\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources\\ShellExperienceHost.exe\", \"C:\\refruntimeBrokerhostSvc\\Idle.exe\", \"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\taskhostw.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.it-it\\OfficeClickToRun.exe\", \"C:\\PerfLogs\\explorer.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\services.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\services.exe\", \"C:\\Windows\\System32\\sppinst\\conhost.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	3564	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	3564	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	3564	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	3564	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	3564	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	3564	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	3564	schtasks.exe	15
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	3564	schtasks.exe	15

DCRat Payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000200000001ab3e-121.dat	dcrat
behavioral2/files/0x000200000001ab3e-122.dat	dcrat
behavioral2/files/0x000100000001ab46-131.dat	dcrat
behavioral2/files/0x000100000001ab46-132.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
1888	refruntimeBrokerhostSvcSessionperfnet.exe
3840	conhost.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\refruntimeBrokerhostSvc\\Idle.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\taskhostw.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\PerfLogs\\explorer.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Media Player\\services.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources\\ShellExperienceHost.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\resources\\ShellExperienceHost.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\refruntimeBrokerhostSvc\\Idle.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Media Player\\services.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\PerfLogs\\explorer.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\sppinst\\conhost.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\sppinst\\conhost.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\\taskhostw.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.it-it\\OfficeClickToRun.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.it-it\\OfficeClickToRun.exe\""	refruntimeBrokerhostSvcSessionperfnet.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\sppinst\conhost.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\sppinst\088424020bedd6b28ac7fd22ee35dcd7322895ce	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\taskhostw.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	refruntimeBrokerhostSvcSessionperfnet.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\services.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\services.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Program Files (x86)\Windows Media Player\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it\OfficeClickToRun.exe	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it\e6c9b481da804f07baff8eff543b0a1441069b5d	refruntimeBrokerhostSvcSessionperfnet.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\resources\f8c8f1285d826bc63910aaf97db97186ba642b4f	refruntimeBrokerhostSvcSessionperfnet.exe
File created	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\resources\ShellExperienceHost.exe	refruntimeBrokerhostSvcSessionperfnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4000	schtasks.exe
4016	schtasks.exe
3984	schtasks.exe
4072	schtasks.exe
2472	schtasks.exe
2768	schtasks.exe
3052	schtasks.exe
3844	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	refruntimeBrokerhostSvcSessionperfnet.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1888	refruntimeBrokerhostSvcSessionperfnet.exe
1888	refruntimeBrokerhostSvcSessionperfnet.exe
1888	refruntimeBrokerhostSvcSessionperfnet.exe
1888	refruntimeBrokerhostSvcSessionperfnet.exe
1888	refruntimeBrokerhostSvcSessionperfnet.exe
3840	conhost.exe
3840	conhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	refruntimeBrokerhostSvcSessionperfnet.exe
Token: SeDebugPrivilege	3840	conhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1160	992	95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe	68
PID 992 wrote to memory of 1160	992	95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe	68
PID 992 wrote to memory of 1160	992	95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe	68
PID 1160 wrote to memory of 1572	1160	WScript.exe	69
PID 1160 wrote to memory of 1572	1160	WScript.exe	69
PID 1160 wrote to memory of 1572	1160	WScript.exe	69
PID 1572 wrote to memory of 1888	1572	cmd.exe	71
PID 1572 wrote to memory of 1888	1572	cmd.exe	71
PID 1888 wrote to memory of 3152	1888	refruntimeBrokerhostSvcSessionperfnet.exe	81
PID 1888 wrote to memory of 3152	1888	refruntimeBrokerhostSvcSessionperfnet.exe	81
PID 3152 wrote to memory of 988	3152	cmd.exe	83
PID 3152 wrote to memory of 988	3152	cmd.exe	83
PID 3152 wrote to memory of 4028	3152	cmd.exe	84
PID 3152 wrote to memory of 4028	3152	cmd.exe	84
PID 3152 wrote to memory of 3840	3152	cmd.exe	86
PID 3152 wrote to memory of 3840	3152	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe
"C:\Users\Admin\AppData\Local\Temp\95155b1eb26b2f4d548de9b64239aa4339c191a56b9f1e61697351dced1c9bc7.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\refruntimeBrokerhostSvc\4iPK2TsM.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\refruntimeBrokerhostSvc\KipPUr0.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\refruntimeBrokerhostSvc\refruntimeBrokerhostSvcSessionperfnet.exe
      "C:\refruntimeBrokerhostSvc\refruntimeBrokerhostSvcSessionperfnet.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s4VTiU4l9H.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3152
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:988
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4028
      - C:\Windows\System32\sppinst\conhost.exe
        
        "C:\Windows\System32\sppinst\conhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\sppinst\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\resources\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\refruntimeBrokerhostSvc\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\PerfLogs\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072