dcrat | fec34dd8cbdb2b535687b88287c32a6c5439d9e1f0135ab830ae7bc07d989a73

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07/07/2022, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
surrogatecontainersession.exe
Size 1.3MB
Sample220707-v65raafad2
SHA256 fec34dd8cbdb2b535687b88287c32a6c5439d9e1f0135ab830ae7bc07d989a73
MD5 6d39c8adeb638dad0647cd92f445a5b4
SHA1 46a5d1c8cf2a194c152bc7608b101d8e9ffea7b2
SHA512 cb2bd955f9e40cceb7601bc1aaf24ab8ab2aaf03198c838de72efb77fae0826dd130244d311071edea2cc057a911e93f770d394fd31f35ff63236009fa628745
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat spyware stealer suricata

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	3404	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	3404	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	3404	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	3404	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3404	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	3404	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	3404	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	3404	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	3404	schtasks.exe	45

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1464-130-0x0000000000990000-0x0000000000AEE000-memory.dmp	dcrat
behavioral2/files/0x00040000000225dc-139.dat	dcrat
behavioral2/files/0x00040000000225dc-140.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3160	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	surrogatecontainersession.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\explorer.exe	surrogatecontainersession.exe
File opened for modification	C:\Program Files (x86)\Common Files\explorer.exe	surrogatecontainersession.exe
File created	C:\Program Files (x86)\Common Files\7a0fd90576e088	surrogatecontainersession.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\wininit.exe	surrogatecontainersession.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\56085415360792	surrogatecontainersession.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2516	schtasks.exe
1832	schtasks.exe
2076	schtasks.exe
4236	schtasks.exe
3324	schtasks.exe
1664	schtasks.exe
4864	schtasks.exe
3132	schtasks.exe
4660	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	surrogatecontainersession.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1464	surrogatecontainersession.exe
1464	surrogatecontainersession.exe
1464	surrogatecontainersession.exe
1464	surrogatecontainersession.exe
1464	surrogatecontainersession.exe
1464	surrogatecontainersession.exe
1464	surrogatecontainersession.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3160	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	surrogatecontainersession.exe
Token: SeDebugPrivilege	3160	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 4620	1464	surrogatecontainersession.exe	88
PID 1464 wrote to memory of 4620	1464	surrogatecontainersession.exe	88
PID 4620 wrote to memory of 2316	4620	cmd.exe	90
PID 4620 wrote to memory of 2316	4620	cmd.exe	90
PID 4620 wrote to memory of 3160	4620	cmd.exe	91
PID 4620 wrote to memory of 3160	4620	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\surrogatecontainersession.exe
"C:\Users\Admin\AppData\Local\Temp\surrogatecontainersession.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qK9JvzzoEm.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2316
- - C:\Program Files (x86)\Common Files\explorer.exe
    "C:\Program Files (x86)\Common Files\explorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Gadgets\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe

Path C:\Program Files (x86)\Common Files\explorer.exe
Size 1.3MB
SHA256 fec34dd8cbdb2b535687b88287c32a6c5439d9e1f0135ab830ae7bc07d989a73
MD5 6d39c8adeb638dad0647cd92f445a5b4
SHA1 46a5d1c8cf2a194c152bc7608b101d8e9ffea7b2
SHA512 cb2bd955f9e40cceb7601bc1aaf24ab8ab2aaf03198c838de72efb77fae0826dd130244d311071edea2cc057a911e93f770d394fd31f35ff63236009fa628745
SSDEEP 24576:0rmYuARseV2e4czm+BLC6cg2FGHFgPXcaGWwJsp9SGyIO:0iGRserQlGgfuOpoBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Program Files (x86)\Common Files\explorer.exe
Size 1.3MB
SHA256 fec34dd8cbdb2b535687b88287c32a6c5439d9e1f0135ab830ae7bc07d989a73
MD5 6d39c8adeb638dad0647cd92f445a5b4
SHA1 46a5d1c8cf2a194c152bc7608b101d8e9ffea7b2
SHA512 cb2bd955f9e40cceb7601bc1aaf24ab8ab2aaf03198c838de72efb77fae0826dd130244d311071edea2cc057a911e93f770d394fd31f35ff63236009fa628745
SSDEEP 24576:0rmYuARseV2e4czm+BLC6cg2FGHFgPXcaGWwJsp9SGyIO:0iGRserQlGgfuOpoBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

qK9JvzzoEm.bat

Path C:\Users\Admin\AppData\Local\Temp\qK9JvzzoEm.bat
Size 213B
SHA256 1a835e6a1d14eef1c25fbc5b286783b722b49136e02e5a6a2d846fa22d7416ca
MD5 959dadfa5742db2f1f92c712b360bf49
SHA1 995e09d8c2736564c0e270679699a20dbb257a68
SHA512 642c9edeb107c825db20a0f2061f0c69314128d22974b1594aa559f75aa347fa6dfe627962078825fdd8fec7e0235eaf7de77d2ce6b3ed10784fe29231b266c4
MD5 SHA1 SHA512

Submit Download

memory/1464-133-0x00007FFC2E530000-0x00007FFC2EFF1000-memory.dmp

Download

memory/1464-130-0x0000000000990000-0x0000000000AEE000-memory.dmp

Download

memory/1464-137-0x00007FFC2E530000-0x00007FFC2EFF1000-memory.dmp

Download

memory/1464-132-0x0000000001460000-0x00000000014B0000-memory.dmp

Download

memory/1464-131-0x00007FFC2E530000-0x00007FFC2EFF1000-memory.dmp

Download

memory/3160-141-0x00007FFC2E420000-0x00007FFC2EEE1000-memory.dmp

Download

memory/3160-142-0x00007FFC2E420000-0x00007FFC2EEE1000-memory.dmp

Download