dcrat | 22a2d7af185892d400b7b98c62dedaf8ff9bfdf65fcc7c6c20d4ca102452db6d

General

Target
54b3ae8eec0c73f0ac6993f761a8b099.exe
Size 4.0MB
Sample220924-sdwa2abeb5
SHA256 22a2d7af185892d400b7b98c62dedaf8ff9bfdf65fcc7c6c20d4ca102452db6d
MD5 54b3ae8eec0c73f0ac6993f761a8b099
SHA1 a8ec0c7bcc845ee8bf9a017830d3d611d0e3287a
SHA512 909fd7d72e6d6aa18fef8b7dcf301716baa6f7fbef75646162d1994ab61c089eeb889412cb3d4b74fce3ad75235911570e18c94b4be65990017214388777890b
SSDEEP 49152:i6Mfs/3KxuSrb/TWvO90d7HjmAFd4A64nsfJkclgXKRQHfD/az1YLm0lhoM9iTdT:b3D68zlhZwTR0A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	1188	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	1188	schtasks.exe	29

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000005c50-55.dat	dcrat
behavioral1/files/0x0007000000005c50-56.dat	dcrat
behavioral1/memory/2036-57-0x0000000000090000-0x0000000000168000-memory.dmp	dcrat
behavioral1/files/0x000b0000000122f1-61.dat	dcrat
behavioral1/files/0x000b0000000122f1-63.dat	dcrat
behavioral1/memory/1764-64-0x0000000001340000-0x0000000001418000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
2036	go-memexec-1040945959.exe
1764	Idle.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Uninstall Information\csrss.exe	go-memexec-1040945959.exe
File created	C:\Program Files (x86)\Uninstall Information\886983d96e3d3e	go-memexec-1040945959.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\spoolsv.exe	go-memexec-1040945959.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\f3b6ecef712a24	go-memexec-1040945959.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
888	schtasks.exe
1072	schtasks.exe
636	schtasks.exe
1388	schtasks.exe
1912	schtasks.exe
1088	schtasks.exe
1668	schtasks.exe
436	schtasks.exe
1612	schtasks.exe
560	schtasks.exe
660	schtasks.exe
1984	schtasks.exe
1924	schtasks.exe
1456	schtasks.exe
756	schtasks.exe
1320	schtasks.exe
964	schtasks.exe
1532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2036	go-memexec-1040945959.exe
1764	Idle.exe
1764	Idle.exe
1764	Idle.exe
1764	Idle.exe
1764	Idle.exe
1764	Idle.exe
1764	Idle.exe
1764	Idle.exe
1764	Idle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	go-memexec-1040945959.exe
Token: SeDebugPrivilege	1764	Idle.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2036	1672	54b3ae8eec0c73f0ac6993f761a8b099.exe	28
PID 1672 wrote to memory of 2036	1672	54b3ae8eec0c73f0ac6993f761a8b099.exe	28
PID 1672 wrote to memory of 2036	1672	54b3ae8eec0c73f0ac6993f761a8b099.exe	28
PID 2036 wrote to memory of 2044	2036	go-memexec-1040945959.exe	48
PID 2036 wrote to memory of 2044	2036	go-memexec-1040945959.exe	48
PID 2036 wrote to memory of 2044	2036	go-memexec-1040945959.exe	48
PID 2044 wrote to memory of 940	2044	cmd.exe	50
PID 2044 wrote to memory of 940	2044	cmd.exe	50
PID 2044 wrote to memory of 940	2044	cmd.exe	50
PID 2044 wrote to memory of 1764	2044	cmd.exe	51
PID 2044 wrote to memory of 1764	2044	cmd.exe	51
PID 2044 wrote to memory of 1764	2044	cmd.exe	51

C:\Users\Admin\AppData\Local\Temp\54b3ae8eec0c73f0ac6993f761a8b099.exe
"C:\Users\Admin\AppData\Local\Temp\54b3ae8eec0c73f0ac6993f761a8b099.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\go-memexec-1040945959.exe
  C:\Users\Admin\AppData\Local\Temp\go-memexec-1040945959.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vY3w7treqw.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:940
  - - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe
      "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Uninstall Information\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Idle.exe

Path C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe
Size 831KB
SHA256 1ca82d84d20a71004931e1abc59949b379b1fcd35037df5fdcb80148721fe8e8
MD5 b7e6718159acb8b5491bcc82a752c59a
SHA1 6bdb48af64d90b7b471f367876a5aff3e121f466
SHA512 13c53a36b8d269d32e3f8091079be07337bdad485084e688362eebe69c29a3966f0137d89f5c1f5f275ac0a8c9eca3f426a3c64001b8fd14aa0826071dd59323
SSDEEP 12288:bf0cZpEXSFE38iRVF1jv3vkYOejEnS+Jhlb1sI:Ic8XSFE3FRVF1jv38IESglb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Idle.exe

Path C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe
Size 831KB
SHA256 1ca82d84d20a71004931e1abc59949b379b1fcd35037df5fdcb80148721fe8e8
MD5 b7e6718159acb8b5491bcc82a752c59a
SHA1 6bdb48af64d90b7b471f367876a5aff3e121f466
SHA512 13c53a36b8d269d32e3f8091079be07337bdad485084e688362eebe69c29a3966f0137d89f5c1f5f275ac0a8c9eca3f426a3c64001b8fd14aa0826071dd59323
SSDEEP 12288:bf0cZpEXSFE38iRVF1jv3vkYOejEnS+Jhlb1sI:Ic8XSFE3FRVF1jv38IESglb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

go-memexec-1040945959.exe

Path C:\Users\Admin\AppData\Local\Temp\go-memexec-1040945959.exe
Size 831KB
SHA256 1ca82d84d20a71004931e1abc59949b379b1fcd35037df5fdcb80148721fe8e8
MD5 b7e6718159acb8b5491bcc82a752c59a
SHA1 6bdb48af64d90b7b471f367876a5aff3e121f466
SHA512 13c53a36b8d269d32e3f8091079be07337bdad485084e688362eebe69c29a3966f0137d89f5c1f5f275ac0a8c9eca3f426a3c64001b8fd14aa0826071dd59323
SSDEEP 12288:bf0cZpEXSFE38iRVF1jv3vkYOejEnS+Jhlb1sI:Ic8XSFE3FRVF1jv38IESglb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

go-memexec-1040945959.exe

Path C:\Users\Admin\AppData\Local\Temp\go-memexec-1040945959.exe
Size 831KB
SHA256 1ca82d84d20a71004931e1abc59949b379b1fcd35037df5fdcb80148721fe8e8
MD5 b7e6718159acb8b5491bcc82a752c59a
SHA1 6bdb48af64d90b7b471f367876a5aff3e121f466
SHA512 13c53a36b8d269d32e3f8091079be07337bdad485084e688362eebe69c29a3966f0137d89f5c1f5f275ac0a8c9eca3f426a3c64001b8fd14aa0826071dd59323
SSDEEP 12288:bf0cZpEXSFE38iRVF1jv3vkYOejEnS+Jhlb1sI:Ic8XSFE3FRVF1jv38IESglb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

vY3w7treqw.bat

Path C:\Users\Admin\AppData\Local\Temp\vY3w7treqw.bat
Size 236B
SHA256 66ca2c827ce6f2633fe5a1b6605d2382eade142b4ebbf62c4bfac223953d7c64
MD5 3f8eae45d46c67ae28c11100f52f1fbc
SHA1 027fd1cfbc4b0180f29297e7df9c8d2afbbec94c
SHA512 fde32f2c1dce9f3b0e030f6378d4cc1d2f2f543183b1786652b1b00fbe5a91d65024d7021bcc532d4022309ad73add2538a13dcf213b5b9cc78019e37893ccc5
MD5 SHA1 SHA512

Submit Download

memory/1764-64-0x0000000001340000-0x0000000001418000-memory.dmp

Download

memory/2036-57-0x0000000000090000-0x0000000000168000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads