dcrat | 2caefa0a7a35443ddd685c40317b88257681b2972c9528cbb20eaeda6e6aa444

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2022, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b925cc022f40bd9760f17382401923a1.exe
Size 2.9MB
Sample220820-dplhmseadq
SHA256 2caefa0a7a35443ddd685c40317b88257681b2972c9528cbb20eaeda6e6aa444
MD5 b925cc022f40bd9760f17382401923a1
SHA1 de1415489a70ee1ef11809ead41935682c8cd6bd
SHA512 f3d9c668bae2298387f9bea7043e57319c2f607366e939f6cdf062f335c1d3265b182bc423f0eaee0e3274117e19a7602bdd47a6e9154ecf4f1077bb26316074
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	4308	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	4308	schtasks.exe	20

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000300000001e7d9-137.dat	dcrat
behavioral2/files/0x000300000001e7d9-138.dat	dcrat
behavioral2/memory/1340-139-0x0000000000980000-0x0000000000C04000-memory.dmp	dcrat
behavioral2/files/0x000400000001e7f2-143.dat	dcrat
behavioral2/files/0x000400000001e7f2-144.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
1340	msRef.exe
2056	WaaSMedicAgent.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation	b925cc022f40bd9760f17382401923a1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation	msRef.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe	msRef.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\66fc9ff0ee96c2	msRef.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SKB\LanguageModels\System.exe	msRef.exe
File created	C:\Windows\SKB\LanguageModels\27d1bcfc3c54e0	msRef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1948	schtasks.exe
1992	schtasks.exe
3536	schtasks.exe
3484	schtasks.exe
4412	schtasks.exe
2472	schtasks.exe
3804	schtasks.exe
3860	schtasks.exe
1440	schtasks.exe
4080	schtasks.exe
780	schtasks.exe
2488	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000_Classes\Local Settings	b925cc022f40bd9760f17382401923a1.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1340	msRef.exe
1340	msRef.exe
1340	msRef.exe
1340	msRef.exe
1340	msRef.exe
1340	msRef.exe
2056	WaaSMedicAgent.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	msRef.exe
Token: SeDebugPrivilege	2056	WaaSMedicAgent.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4064	4192	b925cc022f40bd9760f17382401923a1.exe	82
PID 4192 wrote to memory of 4064	4192	b925cc022f40bd9760f17382401923a1.exe	82
PID 4192 wrote to memory of 4064	4192	b925cc022f40bd9760f17382401923a1.exe	82
PID 4064 wrote to memory of 1824	4064	WScript.exe	85
PID 4064 wrote to memory of 1824	4064	WScript.exe	85
PID 4064 wrote to memory of 1824	4064	WScript.exe	85
PID 1824 wrote to memory of 1340	1824	cmd.exe	87
PID 1824 wrote to memory of 1340	1824	cmd.exe	87
PID 1340 wrote to memory of 2056	1340	msRef.exe	101
PID 1340 wrote to memory of 2056	1340	msRef.exe	101

C:\Users\Admin\AppData\Local\Temp\b925cc022f40bd9760f17382401923a1.exe
"C:\Users\Admin\AppData\Local\Temp\b925cc022f40bd9760f17382401923a1.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\HyperBlockinto\8ByrmhXNvPxprG3WRBxKl.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\HyperBlockinto\37GELo5LtnK3KuG.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\HyperBlockinto\msRef.exe
      "C:\HyperBlockinto\msRef.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1340
    - - C:\Users\Admin\Favorites\Links\WaaSMedicAgent.exe
        
        "C:\Users\Admin\Favorites\Links\WaaSMedicAgent.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Favorites\Links\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Favorites\Links\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\SKB\LanguageModels\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\SKB\LanguageModels\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37GELo5LtnK3KuG.bat

Path C:\HyperBlockinto\37GELo5LtnK3KuG.bat
Size 29B
SHA256 7f74dcf36b1b9e6e0cd479800089d09148f918c316f58e3f27ecbf9415c45264
MD5 b70b8dc2d6f5709a813488f30a7905b0
SHA1 a40ad5246b084789ec9b37774cd2a2338208ac47
SHA512 f6a79befe34d0af9be779e1ccd653c092a43857847decc11b3ab5309d30caa124bf7be5c205bc17688fb0a8d4eecd9163490862214915e45ad30ba18341f9df9
MD5 SHA1 SHA512

Submit Download

8ByrmhXNvPxprG3WRBxKl.vbe

Path C:\HyperBlockinto\8ByrmhXNvPxprG3WRBxKl.vbe
Size 206B
SHA256 033bede50ca0c6d20b9b7b5024e34ab6406e47f960f65b58315cd32dcd517f5e
MD5 cc8f3479b11b3aa5dd843e0210bff7e9
SHA1 bbe7889502d4d6ed9c07681b2d41b6a068f6f09e
SHA512 fc2a2bb51938b75d97d5700d0ed76510494539ab96c1d0911f4a1e1d71400ee75427f207489cb72472f50c6dc8e03531e545491c4922048482d40e3d52874ec5
MD5 SHA1 SHA512

Submit Download

msRef.exe

Path C:\HyperBlockinto\msRef.exe
Size 2.5MB
SHA256 f06ff941c4b0d797493d5ec28b0bd3e87c5fce14779b81205dc88ea2a2377fc7
MD5 e1c3d0adcdded8bcb53be863a770ad30
SHA1 1596cd6faec4919e3ab3674714502fa46a1e8e47
SHA512 fa4338d7221dbf412ab345b692d4b9fc6dbfa98408385fbf2c31fa0d6ad9f42955e81917d105952adac98ac7f423e378500406a0d8526ecff5d169d14ad5c842
SSDEEP 49152:JOdcMnt5p43GQPBGJE2Fjd6OTRTr1laQcC7fRNDLDSFK6:LMzp43GQZGJE2Fj8oZ1Ig7RNve
MD5 SHA1 SHA512 SSDEEP

Submit Download

msRef.exe

Path C:\HyperBlockinto\msRef.exe
Size 2.5MB
SHA256 f06ff941c4b0d797493d5ec28b0bd3e87c5fce14779b81205dc88ea2a2377fc7
MD5 e1c3d0adcdded8bcb53be863a770ad30
SHA1 1596cd6faec4919e3ab3674714502fa46a1e8e47
SHA512 fa4338d7221dbf412ab345b692d4b9fc6dbfa98408385fbf2c31fa0d6ad9f42955e81917d105952adac98ac7f423e378500406a0d8526ecff5d169d14ad5c842
SSDEEP 49152:JOdcMnt5p43GQPBGJE2Fjd6OTRTr1laQcC7fRNDLDSFK6:LMzp43GQZGJE2Fj8oZ1Ig7RNve
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaaSMedicAgent.exe

Path C:\Users\Admin\Favorites\Links\WaaSMedicAgent.exe
Size 2.5MB
SHA256 f06ff941c4b0d797493d5ec28b0bd3e87c5fce14779b81205dc88ea2a2377fc7
MD5 e1c3d0adcdded8bcb53be863a770ad30
SHA1 1596cd6faec4919e3ab3674714502fa46a1e8e47
SHA512 fa4338d7221dbf412ab345b692d4b9fc6dbfa98408385fbf2c31fa0d6ad9f42955e81917d105952adac98ac7f423e378500406a0d8526ecff5d169d14ad5c842
SSDEEP 49152:JOdcMnt5p43GQPBGJE2Fjd6OTRTr1laQcC7fRNDLDSFK6:LMzp43GQZGJE2Fj8oZ1Ig7RNve
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaaSMedicAgent.exe

Path C:\Users\Admin\Favorites\Links\WaaSMedicAgent.exe
Size 2.5MB
SHA256 f06ff941c4b0d797493d5ec28b0bd3e87c5fce14779b81205dc88ea2a2377fc7
MD5 e1c3d0adcdded8bcb53be863a770ad30
SHA1 1596cd6faec4919e3ab3674714502fa46a1e8e47
SHA512 fa4338d7221dbf412ab345b692d4b9fc6dbfa98408385fbf2c31fa0d6ad9f42955e81917d105952adac98ac7f423e378500406a0d8526ecff5d169d14ad5c842
SSDEEP 49152:JOdcMnt5p43GQPBGJE2Fjd6OTRTr1laQcC7fRNDLDSFK6:LMzp43GQZGJE2Fj8oZ1Ig7RNve
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1340-139-0x0000000000980000-0x0000000000C04000-memory.dmp

Download

memory/1340-140-0x00007FFB751B0000-0x00007FFB75C71000-memory.dmp

Download

memory/1340-141-0x0000000002D70000-0x0000000002DC0000-memory.dmp

Download

memory/1340-145-0x00007FFB751B0000-0x00007FFB75C71000-memory.dmp

Download

memory/2056-146-0x00007FFB751B0000-0x00007FFB75C71000-memory.dmp

Download

memory/2056-147-0x00007FFB751B0000-0x00007FFB75C71000-memory.dmp

Download