dcrat | f19c0ee5669a1f7344bd7d1d18e2e40ccb1eca785ca95de441b5799b6d351695

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2022, 03:39

Target
2720dbeaa02495ca1e9dc10c7bcdbbfc.exe
Size 2.1MB
Sample220830-d7l7wscdb5
SHA256 f19c0ee5669a1f7344bd7d1d18e2e40ccb1eca785ca95de441b5799b6d351695
MD5 2720dbeaa02495ca1e9dc10c7bcdbbfc
SHA1 da64fb5ebb8551f8aad68b652c3b6d46cde44d32
SHA512 9e1e9daf2de25e7a3e40968be61b8c58f45c4f104fe303b11b22249696b2b034382f094f90835eb9015277a39ecde36df819a63c25ec2cf4211fe4fe7ab4ee9f
SSDEEP 49152:go5Qp93wvVL7OAxE4b5Wxj7Tt9ZltJZ7Fv4:go5i93wvVL72nLRZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
behavioral2/memory/181104-133-0x0000000000400000-0x0000000000526000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5084 set thread context of 181104	5084	2720dbeaa02495ca1e9dc10c7bcdbbfc.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
181132	5084	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 9 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
181104	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	181104	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 181104	5084	2720dbeaa02495ca1e9dc10c7bcdbbfc.exe	85
PID 5084 wrote to memory of 181104	5084	2720dbeaa02495ca1e9dc10c7bcdbbfc.exe	85
PID 5084 wrote to memory of 181104	5084	2720dbeaa02495ca1e9dc10c7bcdbbfc.exe	85
PID 5084 wrote to memory of 181104	5084	2720dbeaa02495ca1e9dc10c7bcdbbfc.exe	85
PID 5084 wrote to memory of 181104	5084	2720dbeaa02495ca1e9dc10c7bcdbbfc.exe	85

C:\Users\Admin\AppData\Local\Temp\2720dbeaa02495ca1e9dc10c7bcdbbfc.exe
"C:\Users\Admin\AppData\Local\Temp\2720dbeaa02495ca1e9dc10c7bcdbbfc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:181104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 177876
  2⤵
  - Program crash
  PID:181132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5084 -ip 5084
1⤵
PID:181152

memory/181104-133-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/181104-139-0x0000000005750000-0x0000000005CF4000-memory.dmp

Download

memory/181104-140-0x00000000054E0000-0x0000000005530000-memory.dmp

Download

memory/181104-141-0x0000000006320000-0x00000000063B2000-memory.dmp

Download

memory/181104-142-0x0000000006530000-0x0000000006596000-memory.dmp

Download