dcrat | c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e

Analysis

max time kernel
198s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/06/2022, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4825e7df93d8acb3dd236cc14c342a71.exe
Size 1.9MB
Sample220612-rdtxjaeddm
SHA256 c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e
MD5 4825e7df93d8acb3dd236cc14c342a71
SHA1 5cc72cdde2d55a8c5e01ccd80cbb5743bc60ca1b
SHA512 a2e8aa90a719cdddb2f9a4fb21b43f6471cb06e0cb94bd041f26b6a4e11bd820a04c5ea832bb899a91db73d7114b046834afe788d6c03d71b1bf6697272de591
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat Payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1388-148-0x0000000000400000-0x0000000000456000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1548	DllHelper.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	4825e7df93d8acb3dd236cc14c342a71.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 1388	1548	DllHelper.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4356	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1540	PING.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2696	4825e7df93d8acb3dd236cc14c342a71.exe
2696	4825e7df93d8acb3dd236cc14c342a71.exe
2696	4825e7df93d8acb3dd236cc14c342a71.exe
2696	4825e7df93d8acb3dd236cc14c342a71.exe
2696	4825e7df93d8acb3dd236cc14c342a71.exe
2696	4825e7df93d8acb3dd236cc14c342a71.exe
2696	4825e7df93d8acb3dd236cc14c342a71.exe
2696	4825e7df93d8acb3dd236cc14c342a71.exe
2696	4825e7df93d8acb3dd236cc14c342a71.exe
2696	4825e7df93d8acb3dd236cc14c342a71.exe
1548	DllHelper.exe
1548	DllHelper.exe
1548	DllHelper.exe
1548	DllHelper.exe
1548	DllHelper.exe
1548	DllHelper.exe
1548	DllHelper.exe
1548	DllHelper.exe
1548	DllHelper.exe
1548	DllHelper.exe
1388	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4356	2696	4825e7df93d8acb3dd236cc14c342a71.exe	82
PID 2696 wrote to memory of 4356	2696	4825e7df93d8acb3dd236cc14c342a71.exe	82
PID 2696 wrote to memory of 4356	2696	4825e7df93d8acb3dd236cc14c342a71.exe	82
PID 2696 wrote to memory of 1548	2696	4825e7df93d8acb3dd236cc14c342a71.exe	84
PID 2696 wrote to memory of 1548	2696	4825e7df93d8acb3dd236cc14c342a71.exe	84
PID 2696 wrote to memory of 1548	2696	4825e7df93d8acb3dd236cc14c342a71.exe	84
PID 2696 wrote to memory of 4824	2696	4825e7df93d8acb3dd236cc14c342a71.exe	85
PID 2696 wrote to memory of 4824	2696	4825e7df93d8acb3dd236cc14c342a71.exe	85
PID 2696 wrote to memory of 4824	2696	4825e7df93d8acb3dd236cc14c342a71.exe	85
PID 4824 wrote to memory of 1200	4824	cmd.exe	87
PID 4824 wrote to memory of 1200	4824	cmd.exe	87
PID 4824 wrote to memory of 1200	4824	cmd.exe	87
PID 4824 wrote to memory of 1540	4824	cmd.exe	88
PID 4824 wrote to memory of 1540	4824	cmd.exe	88
PID 4824 wrote to memory of 1540	4824	cmd.exe	88
PID 1548 wrote to memory of 1388	1548	DllHelper.exe	95
PID 1548 wrote to memory of 1388	1548	DllHelper.exe	95
PID 1548 wrote to memory of 1388	1548	DllHelper.exe	95
PID 1548 wrote to memory of 1388	1548	DllHelper.exe	95
PID 1548 wrote to memory of 1388	1548	DllHelper.exe	95

C:\Users\Admin\AppData\Local\Temp\4825e7df93d8acb3dd236cc14c342a71.exe
"C:\Users\Admin\AppData\Local\Temp\4825e7df93d8acb3dd236cc14c342a71.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\AppVerif\DllHelper.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4356
- C:\Users\Admin\AppVerif\DllHelper.exe
  "C:\Users\Admin\AppVerif\DllHelper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\4825e7df93d8acb3dd236cc14c342a71.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DllHelper.exe

Path C:\Users\Admin\AppVerif\DllHelper.exe
Size 391.1MB
SHA256 c6b85477d4ec7c8b806fd589378819ca6d785cfd6794ecccc9de5fa13c436f96
MD5 834d819186ecdaba406b83959e1eedc8
SHA1 0bd24d288bdbd9866c224c47c63e4022a6d7c5d3
SHA512 fd4f85cbf9e11a9118927fb48da25fa3f84d16557244f625b72009bc539999a5736bc0ac66930bcfdbf81a4a9ed01f2a47fbf044ea4e683901ce0756c08e9915
SSDEEP 24576:Ware5SMXhd8zlKNfn6LQrmq4Ku0a7ttoXJZ4pt+NfCgPc52L6cnPmJ9C7CnzpCrQ:WvgTW0uNmJPCrjTpM5B3L/q0vlU426
MD5 SHA1 SHA512 SSDEEP

Submit Download

DllHelper.exe

Path C:\Users\Admin\AppVerif\DllHelper.exe
Size 404.7MB
SHA256 4518617e464c026930df3f228b87918309cc6ac6daf4e24af069f8c4a365dc37
MD5 586d14ac0ce0a7f5b00472ce13691139
SHA1 75d873725e3b6d1d7951ddda641f33722da23a78
SHA512 e748cd1e6993b6b363ed0ac107a029c76c44d4ea4cda8133348bbaaa805358fc26669897b4a3a8d192ba21aaab03652f6039dd3f3b417022f7a68509e59101a5
SSDEEP 24576:Ware5SMXhd8zlKNfn6LQrmq4Ku0a7ttoXJZ4pt+NfCgPc52L6cnPmJ9C7CnzpCrQ:WvgTW0uNmJPCrjTpM5B3L/q0vlU426
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1388-150-0x0000000005A70000-0x0000000006014000-memory.dmp

Download

memory/1388-148-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1388-146-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1548-142-0x0000000002543000-0x00000000026E2000-memory.dmp

Download

memory/1548-141-0x0000000002543000-0x00000000026E2000-memory.dmp

Download

memory/1548-143-0x000000000DE50000-0x000000000E146000-memory.dmp

Download

memory/1548-144-0x000000000DE50000-0x000000000E146000-memory.dmp

Download

memory/1548-149-0x0000000002543000-0x00000000026E2000-memory.dmp

Download

memory/2696-131-0x0000000002429000-0x00000000025C8000-memory.dmp

Download

memory/2696-138-0x0000000002429000-0x00000000025C8000-memory.dmp

Download

memory/2696-132-0x0000000002429000-0x00000000025C8000-memory.dmp

Download