dcrat | fd79e637e91ec51483559db807645755dba0ef95199582fb48d4275445dbed5a

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
27/03/2022, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
216de5da1a82038afe995095baacc128.exe
Size 2.5MB
Sample220327-dcx1xaggem
SHA256 fd79e637e91ec51483559db807645755dba0ef95199582fb48d4275445dbed5a
MD5 216de5da1a82038afe995095baacc128
SHA1 697f44839094b33c13f2f47bdf6aa52f7c536573
SHA512 411f7d9793ccaaacfb438c4470145346531d2e5a02a40751930711742b714cd82657660a955e2f4c94417316615119cd7316bac0797da69f4fff35e2376370b8
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat spyware stealer suricata

Malware Config

Signatures

DcRat 6 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
File created	C:\Windows\WaaS\tasks\fontdrvhost.exe		216de5da1a82038afe995095baacc128.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Admin\\SendTo\\OfficeClickToRun.exe\""		216de5da1a82038afe995095baacc128.exe
		3380	schtasks.exe
		3384	schtasks.exe
		4676	schtasks.exe
		3120	schtasks.exe

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	428	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	428	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	428	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	428	schtasks.exe	79

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

Executes dropped EXE 1 IoCs

pid	Process
3592	lsass.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	216de5da1a82038afe995095baacc128.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	lsass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Search.Core\\SearchApp.exe\""	216de5da1a82038afe995095baacc128.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Admin\\SendTo\\OfficeClickToRun.exe\""	216de5da1a82038afe995095baacc128.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\dmxmlhelputils\\lsass.exe\""	216de5da1a82038afe995095baacc128.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Documents and Settings\\RuntimeBroker.exe\""	216de5da1a82038afe995095baacc128.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\dmxmlhelputils\RCX7070.tmp	216de5da1a82038afe995095baacc128.exe
File opened for modification	C:\Windows\System32\dmxmlhelputils\lsass.exe	216de5da1a82038afe995095baacc128.exe
File created	C:\Windows\System32\dmxmlhelputils\lsass.exe	216de5da1a82038afe995095baacc128.exe
File created	C:\Windows\System32\dmxmlhelputils\6203df4a6bafc7	216de5da1a82038afe995095baacc128.exe
File opened for modification	C:\Windows\System32\dmxmlhelputils\RCX6B8D.tmp	216de5da1a82038afe995095baacc128.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Search.Core\SearchApp.exe	216de5da1a82038afe995095baacc128.exe
File created	C:\Windows\WaaS\tasks\fontdrvhost.exe	216de5da1a82038afe995095baacc128.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Search.Core\SearchApp.exe	216de5da1a82038afe995095baacc128.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Search.Core\38384e6a620884	216de5da1a82038afe995095baacc128.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Search.Core\RCX7620.tmp	216de5da1a82038afe995095baacc128.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Search.Core\RCX76EC.tmp	216de5da1a82038afe995095baacc128.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3120	schtasks.exe
3380	schtasks.exe
3384	schtasks.exe
4676	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	216de5da1a82038afe995095baacc128.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	lsass.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2864	216de5da1a82038afe995095baacc128.exe
1284	powershell.exe
1248	powershell.exe
2044	powershell.exe
2200	powershell.exe
1288	powershell.exe
2044	powershell.exe
1284	powershell.exe
1248	powershell.exe
2200	powershell.exe
1288	powershell.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe
3592	lsass.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3592	lsass.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	216de5da1a82038afe995095baacc128.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	3592	lsass.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2044	2864	216de5da1a82038afe995095baacc128.exe	84
PID 2864 wrote to memory of 2044	2864	216de5da1a82038afe995095baacc128.exe	84
PID 2864 wrote to memory of 1284	2864	216de5da1a82038afe995095baacc128.exe	86
PID 2864 wrote to memory of 1284	2864	216de5da1a82038afe995095baacc128.exe	86
PID 2864 wrote to memory of 2200	2864	216de5da1a82038afe995095baacc128.exe	88
PID 2864 wrote to memory of 2200	2864	216de5da1a82038afe995095baacc128.exe	88
PID 2864 wrote to memory of 1288	2864	216de5da1a82038afe995095baacc128.exe	89
PID 2864 wrote to memory of 1288	2864	216de5da1a82038afe995095baacc128.exe	89
PID 2864 wrote to memory of 1248	2864	216de5da1a82038afe995095baacc128.exe	90
PID 2864 wrote to memory of 1248	2864	216de5da1a82038afe995095baacc128.exe	90
PID 2864 wrote to memory of 652	2864	216de5da1a82038afe995095baacc128.exe	94
PID 2864 wrote to memory of 652	2864	216de5da1a82038afe995095baacc128.exe	94
PID 652 wrote to memory of 816	652	cmd.exe	96
PID 652 wrote to memory of 816	652	cmd.exe	96
PID 652 wrote to memory of 3592	652	cmd.exe	97
PID 652 wrote to memory of 3592	652	cmd.exe	97
PID 3592 wrote to memory of 5060	3592	lsass.exe	100
PID 3592 wrote to memory of 5060	3592	lsass.exe	100
PID 3592 wrote to memory of 1004	3592	lsass.exe	101
PID 3592 wrote to memory of 1004	3592	lsass.exe	101

C:\Users\Admin\AppData\Local\Temp\216de5da1a82038afe995095baacc128.exe
"C:\Users\Admin\AppData\Local\Temp\216de5da1a82038afe995095baacc128.exe"
1⤵
- DcRat
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\216de5da1a82038afe995095baacc128.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SendTo\OfficeClickToRun.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\dmxmlhelputils\lsass.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\RuntimeBroker.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Search.Core\SearchApp.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r4hVJnWmYq.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:816
- - C:\Windows\System32\dmxmlhelputils\lsass.exe
    "C:\Windows\System32\dmxmlhelputils\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f36b952-c126-4100-b457-d17301015c47.vbs"
      4⤵
      PID:5060
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9a0beb2-735f-478e-b9cb-454ff1fe0ceb.vbs"
      4⤵
      PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\dmxmlhelputils\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Documents and Settings\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Search.Core\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-156-0x000001ED144D0000-0x000001ED14F91000-memory.dmp

Download

memory/1248-157-0x000001ED2D0D0000-0x000001ED2D0D2000-memory.dmp

Download

memory/1248-158-0x000001ED2D0D3000-0x000001ED2D0D5000-memory.dmp

Download

memory/1248-161-0x000001ED2D0D6000-0x000001ED2D0D8000-memory.dmp

Download

memory/1284-148-0x000002F72F640000-0x000002F72F642000-memory.dmp

Download

memory/1284-150-0x000002F72F643000-0x000002F72F645000-memory.dmp

Download

memory/1284-140-0x000002F72F5F0000-0x000002F72F612000-memory.dmp

Download

memory/1284-160-0x000002F72F646000-0x000002F72F648000-memory.dmp

Download

memory/1284-147-0x000002F72EA80000-0x000002F72F541000-memory.dmp

Download

memory/1288-153-0x000001A219B60000-0x000001A21A621000-memory.dmp

Download

memory/1288-154-0x000001A232930000-0x000001A232932000-memory.dmp

Download

memory/1288-155-0x000001A232933000-0x000001A232935000-memory.dmp

Download

memory/1288-163-0x000001A232936000-0x000001A232938000-memory.dmp

Download

memory/2044-159-0x000002311C656000-0x000002311C658000-memory.dmp

Download

memory/2044-144-0x0000023103A00000-0x00000231044C1000-memory.dmp

Download

memory/2044-145-0x000002311C650000-0x000002311C652000-memory.dmp

Download

memory/2044-146-0x000002311C653000-0x000002311C655000-memory.dmp

Download

memory/2200-152-0x00000189ECF53000-0x00000189ECF55000-memory.dmp

Download

memory/2200-162-0x00000189ECF56000-0x00000189ECF58000-memory.dmp

Download

memory/2200-149-0x00000189D4160000-0x00000189D4C21000-memory.dmp

Download

memory/2200-151-0x00000189ECF50000-0x00000189ECF52000-memory.dmp

Download

memory/2864-133-0x0000000003380000-0x00000000033D0000-memory.dmp

Download

memory/2864-134-0x000000001CCC0000-0x000000001D1E8000-memory.dmp

Download

memory/2864-131-0x00007FF955020000-0x00007FF955AE1000-memory.dmp

Download

memory/2864-130-0x0000000000FF0000-0x0000000001270000-memory.dmp

Download

memory/2864-132-0x000000001BE90000-0x000000001BE92000-memory.dmp

Download

memory/3592-173-0x0000000000D50000-0x0000000000FD0000-memory.dmp

Download

memory/3592-174-0x00007FF955020000-0x00007FF955AE1000-memory.dmp

Download