dcrat | bde5677139804801b06f481a12938995ea2f2d214bd2dd0070630d3de8ae22f5

General

Target
affa90aed3528b47230bfc38628fc409.exe
Size 1.1MB
Sample220215-d3mymacbdr
SHA256 bde5677139804801b06f481a12938995ea2f2d214bd2dd0070630d3de8ae22f5
MD5 affa90aed3528b47230bfc38628fc409
SHA1 853c565c23051c6391767aeb89f079fb0e7a08d8
SHA512 090cd56f73949026ded27b874623f2c6d73a9f2645024a989ec931ec4dcc7acdc56ae5fd2e63d9bcbc517e3eabd3453f3627bc76549a1c0eb7933a8ae1704c68
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat spyware stealer suricata

Malware Config

Signatures

DcRat 7 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1468	schtasks.exe
		936	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\affa90aed3528b47230bfc38628fc409 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lpksetup-20211208-153457-0\\affa90aed3528b47230bfc38628fc409.exe\""		affa90aed3528b47230bfc38628fc409.exe
		1768	schtasks.exe
		984	schtasks.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\lsm.exe		affa90aed3528b47230bfc38628fc409.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\lsm.exe\""		affa90aed3528b47230bfc38628fc409.exe

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	240	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	240	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	240	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	240	schtasks.exe	27

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

Executes dropped EXE 1 IoCs

pid	Process
1368	winlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\affa90aed3528b47230bfc38628fc409 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lpksetup-20211208-153457-0\\affa90aed3528b47230bfc38628fc409.exe\""	affa90aed3528b47230bfc38628fc409.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\mfc140chs\\winlogon.exe\""	affa90aed3528b47230bfc38628fc409.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\PerfLogs\\Admin\\System.exe\""	affa90aed3528b47230bfc38628fc409.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\lsm.exe\""	affa90aed3528b47230bfc38628fc409.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ipinfo.io
9	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\mfc140chs\RCXC9C8.tmp	affa90aed3528b47230bfc38628fc409.exe
File opened for modification	C:\Windows\System32\mfc140chs\winlogon.exe	affa90aed3528b47230bfc38628fc409.exe
File created	C:\Windows\System32\mfc140chs\winlogon.exe	affa90aed3528b47230bfc38628fc409.exe
File created	C:\Windows\System32\mfc140chs\cc11b995f2a76d	affa90aed3528b47230bfc38628fc409.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\lsm.exe	affa90aed3528b47230bfc38628fc409.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\lsm.exe	affa90aed3528b47230bfc38628fc409.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\101b941d020240	affa90aed3528b47230bfc38628fc409.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCXC4D6.tmp	affa90aed3528b47230bfc38628fc409.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
936	schtasks.exe
1768	schtasks.exe
984	schtasks.exe
1468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
620	affa90aed3528b47230bfc38628fc409.exe
620	affa90aed3528b47230bfc38628fc409.exe
620	affa90aed3528b47230bfc38628fc409.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe
1368	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1368	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	affa90aed3528b47230bfc38628fc409.exe
Token: SeDebugPrivilege	1368	winlogon.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1100	620	affa90aed3528b47230bfc38628fc409.exe	32
PID 620 wrote to memory of 1100	620	affa90aed3528b47230bfc38628fc409.exe	32
PID 620 wrote to memory of 1100	620	affa90aed3528b47230bfc38628fc409.exe	32
PID 1100 wrote to memory of 1808	1100	cmd.exe	34
PID 1100 wrote to memory of 1808	1100	cmd.exe	34
PID 1100 wrote to memory of 1808	1100	cmd.exe	34
PID 1100 wrote to memory of 1368	1100	cmd.exe	35
PID 1100 wrote to memory of 1368	1100	cmd.exe	35
PID 1100 wrote to memory of 1368	1100	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\affa90aed3528b47230bfc38628fc409.exe
"C:\Users\Admin\AppData\Local\Temp\affa90aed3528b47230bfc38628fc409.exe"
1⤵
- DcRat
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PsMCD3HM0P.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1808
- - C:\Windows\System32\mfc140chs\winlogon.exe
    "C:\Windows\System32\mfc140chs\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "affa90aed3528b47230bfc38628fc409" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\lpksetup-20211208-153457-0\affa90aed3528b47230bfc38628fc409.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\mfc140chs\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\PerfLogs\Admin\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984