dcrat | 039bfa8758ef030db666783432b432dce2b8c72e32ff01b391d76d1de42fc8a6

General

Target
bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
Size 828KB
Sample220626-leq95scdc2
SHA256 039bfa8758ef030db666783432b432dce2b8c72e32ff01b391d76d1de42fc8a6
MD5 bbfb7bf36044ce93cd2dac1dd2ca69ca
SHA1 b1846fc8dd4f3774630d752768347ffd739aeb63
SHA512 38c5dd9f5895b9a914d6a59e1e3815b35948e442ce89b0702521b35c343677bf085db56abbd63e8816c4d78e1a6d8756d1f12033605bb9cfacd37e5221539a43
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat suricata

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	4552	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	4552	schtasks.exe	43

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

DCRat Payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4476-130-0x0000000000860000-0x0000000000936000-memory.dmp	dcrat
behavioral2/files/0x0008000000022ed5-133.dat	dcrat
behavioral2/files/0x0008000000022ed5-134.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
768	lsass.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\en-US\6203df4a6bafc7	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\RuntimeBroker.exe	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\9e8d7a4ca61bd9	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\explorer.exe	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\7a0fd90576e088	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3880	schtasks.exe
4696	schtasks.exe
4892	schtasks.exe
4676	schtasks.exe
4200	schtasks.exe
3468	schtasks.exe
4152	schtasks.exe
1736	schtasks.exe
3844	schtasks.exe
4692	schtasks.exe
1056	schtasks.exe
1432	schtasks.exe
4688	schtasks.exe
1296	schtasks.exe
3864	schtasks.exe
2264	schtasks.exe
3692	schtasks.exe
3644	schtasks.exe
4480	schtasks.exe
3304	schtasks.exe
2300	schtasks.exe
1660	schtasks.exe
4192	schtasks.exe
516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4476	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
4476	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
4476	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
768	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
Token: SeDebugPrivilege	768	lsass.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 768	4476	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe	104
PID 4476 wrote to memory of 768	4476	bbfb7bf36044ce93cd2dac1dd2ca69ca.exe	104

C:\Users\Admin\AppData\Local\Temp\bbfb7bf36044ce93cd2dac1dd2ca69ca.exe
"C:\Users\Admin\AppData\Local\Temp\bbfb7bf36044ce93cd2dac1dd2ca69ca.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe
  "C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bbfb7bf36044ce93cd2dac1dd2ca69cab" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\bbfb7bf36044ce93cd2dac1dd2ca69ca.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bbfb7bf36044ce93cd2dac1dd2ca69ca" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\bbfb7bf36044ce93cd2dac1dd2ca69ca.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bbfb7bf36044ce93cd2dac1dd2ca69cab" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\bbfb7bf36044ce93cd2dac1dd2ca69ca.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bbfb7bf36044ce93cd2dac1dd2ca69cab" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\bbfb7bf36044ce93cd2dac1dd2ca69ca.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bbfb7bf36044ce93cd2dac1dd2ca69ca" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\bbfb7bf36044ce93cd2dac1dd2ca69ca.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bbfb7bf36044ce93cd2dac1dd2ca69cab" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\bbfb7bf36044ce93cd2dac1dd2ca69ca.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe
Size 828KB
SHA256 039bfa8758ef030db666783432b432dce2b8c72e32ff01b391d76d1de42fc8a6
MD5 bbfb7bf36044ce93cd2dac1dd2ca69ca
SHA1 b1846fc8dd4f3774630d752768347ffd739aeb63
SHA512 38c5dd9f5895b9a914d6a59e1e3815b35948e442ce89b0702521b35c343677bf085db56abbd63e8816c4d78e1a6d8756d1f12033605bb9cfacd37e5221539a43
SSDEEP 12288:PpEmPJ3CmG/oYHUIXgWEfHUAtgjzGGSERGycs:ymx3Cm8oYHUIXgWEgWGDGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe
Size 828KB
SHA256 039bfa8758ef030db666783432b432dce2b8c72e32ff01b391d76d1de42fc8a6
MD5 bbfb7bf36044ce93cd2dac1dd2ca69ca
SHA1 b1846fc8dd4f3774630d752768347ffd739aeb63
SHA512 38c5dd9f5895b9a914d6a59e1e3815b35948e442ce89b0702521b35c343677bf085db56abbd63e8816c4d78e1a6d8756d1f12033605bb9cfacd37e5221539a43
SSDEEP 12288:PpEmPJ3CmG/oYHUIXgWEfHUAtgjzGGSERGycs:ymx3Cm8oYHUIXgWEgWGDGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/768-136-0x00007FFB09C60000-0x00007FFB0A721000-memory.dmp

Download

memory/768-137-0x00007FFB09C60000-0x00007FFB0A721000-memory.dmp

Download

memory/4476-130-0x0000000000860000-0x0000000000936000-memory.dmp

Download

memory/4476-131-0x00007FFB09C60000-0x00007FFB0A721000-memory.dmp

Download

memory/4476-135-0x00007FFB09C60000-0x00007FFB0A721000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads