dcrat | 1eb23606ac29d2eb83bb2ecef63d8258e734d277a69627ea3c349458fc240389

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/09/2022, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sdfafdsg.exe
Size 1012KB
Sample220910-nlkgaaaae8
SHA256 1eb23606ac29d2eb83bb2ecef63d8258e734d277a69627ea3c349458fc240389
MD5 576b4a5b9b46b855743cfba07b455756
SHA1 2072dbed8d16aba233dc00df32038766de821977
SHA512 eee2f3fdb04f7402b20717cfb9de40d0460bc163ca8158e869e0c2c9aae886cd9dd8956d08d2700051aaf21351f851c76a6c733220fd8a1a40181f54882d98ec
SSDEEP 12288:iMZxtBm9GqBK4uwXL99Gwyo81r5QpSrjAF7LQ2N+4C6xnetB+cdyaMvFLitk3h5r:iuxT4BrL7Gwyfuoj47zMbeFLVxJH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/99664-56-0x0000000000400000-0x00000000004B6000-memory.dmp	dcrat
behavioral1/memory/99664-61-0x00000000004B081E-mapping.dmp	dcrat
behavioral1/memory/99664-62-0x0000000000400000-0x00000000004B6000-memory.dmp	dcrat
behavioral1/memory/99664-63-0x0000000000400000-0x00000000004B6000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1280 set thread context of 99664	1280	sdfafdsg.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
99704	1280	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe
99664	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	99664	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 99664	1280	sdfafdsg.exe	29
PID 1280 wrote to memory of 99664	1280	sdfafdsg.exe	29
PID 1280 wrote to memory of 99664	1280	sdfafdsg.exe	29
PID 1280 wrote to memory of 99664	1280	sdfafdsg.exe	29
PID 1280 wrote to memory of 99664	1280	sdfafdsg.exe	29
PID 1280 wrote to memory of 99664	1280	sdfafdsg.exe	29
PID 1280 wrote to memory of 99664	1280	sdfafdsg.exe	29
PID 1280 wrote to memory of 99664	1280	sdfafdsg.exe	29
PID 1280 wrote to memory of 99664	1280	sdfafdsg.exe	29
PID 1280 wrote to memory of 99704	1280	sdfafdsg.exe	30
PID 1280 wrote to memory of 99704	1280	sdfafdsg.exe	30
PID 1280 wrote to memory of 99704	1280	sdfafdsg.exe	30
PID 1280 wrote to memory of 99704	1280	sdfafdsg.exe	30

C:\Users\Admin\AppData\Local\Temp\sdfafdsg.exe
"C:\Users\Admin\AppData\Local\Temp\sdfafdsg.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:99664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 98252
  2⤵
  - Program crash
  PID:99704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/99664-54-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/99664-56-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/99664-62-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/99664-63-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/99664-64-0x0000000075811000-0x0000000075813000-memory.dmp

Download

memory/99664-66-0x00000000003E0000-0x00000000003FC000-memory.dmp

Download

memory/99664-67-0x00000000004D0000-0x00000000004E6000-memory.dmp

Download

memory/99664-68-0x0000000000500000-0x000000000050E000-memory.dmp

Download