dcrat | 13b9b3ae4d0e94099f69c0968b770ad5651b6d23f043a6bc34a3475f5167fc6d

General

Target
d4c89ca639391f091d2ef4f2e0ecdd59.exe
Size 1.4MB
Sample211110-dcq8csdcgk
SHA256 13b9b3ae4d0e94099f69c0968b770ad5651b6d23f043a6bc34a3475f5167fc6d
MD5 d4c89ca639391f091d2ef4f2e0ecdd59
SHA1 aeebb9eec1ba7324f12f151e768e0b1e91ec9548
SHA512 4b8cd0ec03c1314cae6f50a7f3912e0873d6ce81dfccc51235a76d465f69590fff1f225dc0f5eaae334953a0e5a81c6ba6377a02d48f065b3792203480dab06d
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat suricata

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	1344	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	1344	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	1344	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1344	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	1344	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1344	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	1344	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	1344	schtasks.exe	32

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

DCRat Payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000012200-61.dat	dcrat
behavioral1/files/0x0007000000012200-63.dat	dcrat
behavioral1/files/0x0007000000012200-62.dat	dcrat
behavioral1/files/0x0007000000012200-65.dat	dcrat
behavioral1/files/0x0006000000012216-70.dat	dcrat
behavioral1/files/0x0006000000012216-71.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
1132	savesHostNetwinPerfcommon.exe
1092	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
812	cmd.exe
812	cmd.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\SysWOW64\\WsmAuto\\cmd.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\savesHostNet\\services.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\svchost\\csrss.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\bootstat\\explorer.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\MediaMetadataHandler\\dwm.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Documents and Settings\\csrss.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\ProgramData\\Start Menu\\winlogon.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\pnpsetup\\WmiPrvSE.exe\""	savesHostNetwinPerfcommon.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\wbem\pnpsetup\WmiPrvSE.exe	savesHostNetwinPerfcommon.exe
File created	C:\Windows\System32\wbem\pnpsetup\24dbde2999530ef5fd907494bc374d663924116c	savesHostNetwinPerfcommon.exe
File created	C:\Windows\SysWOW64\WsmAuto\cmd.exe	savesHostNetwinPerfcommon.exe
File created	C:\Windows\SysWOW64\WsmAuto\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228	savesHostNetwinPerfcommon.exe
File created	C:\Windows\System32\svchost\csrss.exe	savesHostNetwinPerfcommon.exe
File created	C:\Windows\System32\svchost\886983d96e3d3e31032c679b2d4ea91b6c05afef	savesHostNetwinPerfcommon.exe
File created	C:\Windows\System32\MediaMetadataHandler\dwm.exe	savesHostNetwinPerfcommon.exe
File created	C:\Windows\System32\MediaMetadataHandler\6cb0b6c459d5d3455a3da700e713f2e2529862ff	savesHostNetwinPerfcommon.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\bootstat\explorer.exe	savesHostNetwinPerfcommon.exe
File created	C:\Windows\bootstat\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	savesHostNetwinPerfcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1256	schtasks.exe
1536	schtasks.exe
860	schtasks.exe
1904	schtasks.exe
1104	schtasks.exe
1928	schtasks.exe
1064	schtasks.exe
840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1132	savesHostNetwinPerfcommon.exe
1132	savesHostNetwinPerfcommon.exe
1132	savesHostNetwinPerfcommon.exe
1092	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	savesHostNetwinPerfcommon.exe
Token: SeDebugPrivilege	1092	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 556	1888	d4c89ca639391f091d2ef4f2e0ecdd59.exe	28
PID 1888 wrote to memory of 556	1888	d4c89ca639391f091d2ef4f2e0ecdd59.exe	28
PID 1888 wrote to memory of 556	1888	d4c89ca639391f091d2ef4f2e0ecdd59.exe	28
PID 1888 wrote to memory of 556	1888	d4c89ca639391f091d2ef4f2e0ecdd59.exe	28
PID 556 wrote to memory of 812	556	WScript.exe	29
PID 556 wrote to memory of 812	556	WScript.exe	29
PID 556 wrote to memory of 812	556	WScript.exe	29
PID 556 wrote to memory of 812	556	WScript.exe	29
PID 812 wrote to memory of 1132	812	cmd.exe	31
PID 812 wrote to memory of 1132	812	cmd.exe	31
PID 812 wrote to memory of 1132	812	cmd.exe	31
PID 812 wrote to memory of 1132	812	cmd.exe	31
PID 1132 wrote to memory of 1092	1132	savesHostNetwinPerfcommon.exe	41
PID 1132 wrote to memory of 1092	1132	savesHostNetwinPerfcommon.exe	41
PID 1132 wrote to memory of 1092	1132	savesHostNetwinPerfcommon.exe	41

C:\Users\Admin\AppData\Local\Temp\d4c89ca639391f091d2ef4f2e0ecdd59.exe
"C:\Users\Admin\AppData\Local\Temp\d4c89ca639391f091d2ef4f2e0ecdd59.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\savesHostNet\qYFJhNGJF1Ik4OAQHXWMZ1c3Fk.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\savesHostNet\noNjApR3JG8.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\savesHostNet\savesHostNetwinPerfcommon.exe
      "C:\savesHostNet\savesHostNetwinPerfcommon.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Windows\System32\wbem\pnpsetup\WmiPrvSE.exe
        
        "C:\Windows\System32\wbem\pnpsetup\WmiPrvSE.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\pnpsetup\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\SysWOW64\WsmAuto\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\savesHostNet\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\svchost\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\bootstat\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\MediaMetadataHandler\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:840