dcrat | 71840b9aa4d1868c8a090d5b591fb9df218813aad842ea42472efe65c9d5aa02

General

Target
e9589c076fc51d358fe5eece0b2381da.exe
Size 1.3MB
Sample220308-vw3tyacedp
SHA256 71840b9aa4d1868c8a090d5b591fb9df218813aad842ea42472efe65c9d5aa02
MD5 e9589c076fc51d358fe5eece0b2381da
SHA1 4646d66273aefe1cd6638b20dbd50a93d81eb18e
SHA512 eddefa8d6d3c4217c052d9b35ef86efd53e14bd9d1518f50fa4276d403afe5d891ffe1920cf1c4a598a95370513f90cf82c7ee40b9f21efab9cf014704146000
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 10 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
File created	C:\Windows\SysWOW64\esevss\cc11b995f2a76d		e9589c076fc51d358fe5eece0b2381da.exe
		2604	schtasks.exe
		3716	schtasks.exe
		528	schtasks.exe
		464	schtasks.exe
		1096	schtasks.exe
File created	C:\Windows\SysWOW64\esevss\winlogon.exe		e9589c076fc51d358fe5eece0b2381da.exe
		3060	schtasks.exe
		544	schtasks.exe
		1784	schtasks.exe

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	3788	schtasks.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	3788	schtasks.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	3788	schtasks.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	3788	schtasks.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	3788	schtasks.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	3788	schtasks.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	3788	schtasks.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	3788	schtasks.exe	61

Executes dropped EXE 1 IoCs

pid	Process
3948	winlogon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	e9589c076fc51d358fe5eece0b2381da.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\it-IT\\wininit.exe\""	e9589c076fc51d358fe5eece0b2381da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\utildll\\winlogon.exe\""	e9589c076fc51d358fe5eece0b2381da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\GameChatOverlayExt\\fontdrvhost.exe\""	e9589c076fc51d358fe5eece0b2381da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\Pimstore\\RuntimeBroker.exe\""	e9589c076fc51d358fe5eece0b2381da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\PFRO\\explorer.exe\""	e9589c076fc51d358fe5eece0b2381da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\wlan\\WmiPrvSE.exe\""	e9589c076fc51d358fe5eece0b2381da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\esevss\\winlogon.exe\""	e9589c076fc51d358fe5eece0b2381da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\mai\\LC_MESSAGES\\winlogon.exe\""	e9589c076fc51d358fe5eece0b2381da.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\esevss\winlogon.exe	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\esevss\cc11b995f2a76d	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\utildll\cc11b995f2a76d	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\Pimstore\RuntimeBroker.exe	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\Pimstore\9e8d7a4ca61bd9	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\wbem\wlan\WmiPrvSE.exe	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\esevss\winlogon.exe	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\GameChatOverlayExt\fontdrvhost.exe	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\GameChatOverlayExt\5b884080fd4f94	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\wbem\wlan\24dbde2999530e	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\SysWOW64\utildll\winlogon.exe	e9589c076fc51d358fe5eece0b2381da.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs

pid	Process
4012	e9589c076fc51d358fe5eece0b2381da.exe
4012	e9589c076fc51d358fe5eece0b2381da.exe
4012	e9589c076fc51d358fe5eece0b2381da.exe
4012	e9589c076fc51d358fe5eece0b2381da.exe
4012	e9589c076fc51d358fe5eece0b2381da.exe
4012	e9589c076fc51d358fe5eece0b2381da.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\winlogon.exe	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\cc11b995f2a76d	e9589c076fc51d358fe5eece0b2381da.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\it-IT\56085415360792	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\PFRO\explorer.exe	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\PFRO\7a0fd90576e088	e9589c076fc51d358fe5eece0b2381da.exe
File created	C:\Windows\it-IT\wininit.exe	e9589c076fc51d358fe5eece0b2381da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3716	schtasks.exe
544	schtasks.exe
528	schtasks.exe
464	schtasks.exe
1784	schtasks.exe
3060	schtasks.exe
1096	schtasks.exe
2604	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings	e9589c076fc51d358fe5eece0b2381da.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4012	e9589c076fc51d358fe5eece0b2381da.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe
3948	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	e9589c076fc51d358fe5eece0b2381da.exe
Token: SeDebugPrivilege	3948	winlogon.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4012	e9589c076fc51d358fe5eece0b2381da.exe
3948	winlogon.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4076	4012	e9589c076fc51d358fe5eece0b2381da.exe	79
PID 4012 wrote to memory of 4076	4012	e9589c076fc51d358fe5eece0b2381da.exe	79
PID 4012 wrote to memory of 4076	4012	e9589c076fc51d358fe5eece0b2381da.exe	79
PID 4076 wrote to memory of 2636	4076	cmd.exe	81
PID 4076 wrote to memory of 2636	4076	cmd.exe	81
PID 4076 wrote to memory of 2636	4076	cmd.exe	81
PID 2636 wrote to memory of 860	2636	w32tm.exe	82
PID 2636 wrote to memory of 860	2636	w32tm.exe	82
PID 4076 wrote to memory of 3948	4076	cmd.exe	83
PID 4076 wrote to memory of 3948	4076	cmd.exe	83
PID 4076 wrote to memory of 3948	4076	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\e9589c076fc51d358fe5eece0b2381da.exe
"C:\Users\Admin\AppData\Local\Temp\e9589c076fc51d358fe5eece0b2381da.exe"
1⤵
- DcRat
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o9vxhoSrJp.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:860
- - C:\Windows\SysWOW64\utildll\winlogon.exe
    "C:\Windows\System32\utildll\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\esevss\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\it-IT\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\utildll\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\GameChatOverlayExt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\Pimstore\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\PFRO\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\wlan\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3060