dcrat | eefb1fbb690c0c28f191fbc443793d4badc01ecee0416a7d3a4e46ecd4583c57

General

Target
EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
Size 1.1MB
Sample211114-qhsdtsgdf2
SHA256 eefb1fbb690c0c28f191fbc443793d4badc01ecee0416a7d3a4e46ecd4583c57
MD5 d1301daeebd92b0d322edd6a7972d494
SHA1 8391265891151e818bb335de8889a048a57c623f
SHA512 3f263149d630254080185dd5affbf220260ad3d9362f20adc10a7a389c1d48253a09b168ac235984009fed3b742c0a8d32fa92758b980d2ae5754b38a006bfaf
MD5 SHA1 SHA512

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	1180	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	1180	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	1180	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	1180	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	1180	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	1180	schtasks.exe	69

DCRat Payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
behavioral2/files/0x000400000001ab97-123.dat	dcrat
behavioral2/files/0x000400000001ab97-122.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
384	winlogon.exe

Adds Run key to start application 2 TTPs 6 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\ErrorDetails\\dllhost.exe\""	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\DevicePairing\\winlogon.exe\""	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom\\OfficeClickToRun.exe\""	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Documents and Settings\\dwm.exe\""	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\ProgramData\\Documents\\sihost.exe\""	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\ErrorDetails\5940a34987c99120d96dace90a3f93f329dcad63	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
File created	C:\Windows\System32\DevicePairing\winlogon.exe	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
File created	C:\Windows\System32\DevicePairing\cc11b995f2a76da408ea6a601e682e64743153ad	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
File created	C:\Windows\System32\ErrorDetails\dllhost.exe	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom\OfficeClickToRun.exe	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom\e6c9b481da804f07baff8eff543b0a1441069b5d	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
8	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
384	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe
Token: SeDebugPrivilege	384	winlogon.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 384	8	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe	76
PID 8 wrote to memory of 384	8	EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe	76