dcrat | 94809441241bafd86a3f771709e66b4e9b674f259f49e1793c78e414d678cc93

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41806c88409d2cf704e9475b84b6e619.exe
Size 1.5MB
Sample221002-srbhsaccd8
SHA256 94809441241bafd86a3f771709e66b4e9b674f259f49e1793c78e414d678cc93
MD5 41806c88409d2cf704e9475b84b6e619
SHA1 2940625c7dddf336db7034419c9439603876edde
SHA512 e98a2bc3ea2c031ee426f4a33c61144f1b4d12eedee9d6cb94628957d82cc8588e306d0a390f41ab362ddb7b2544b26ad9a8105e439e5c175856bcc33367f532
SSDEEP 24576:U2G/nvxW3Ww0tvgsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh6:UbA30vg6uEdpNSULNrqic
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	1364	schtasks.exe	16
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	1364	schtasks.exe	16

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000022e4c-138.dat	dcrat
behavioral2/files/0x0006000000022e4c-139.dat	dcrat
behavioral2/memory/5008-140-0x00000000003F0000-0x000000000052E000-memory.dmp	dcrat
behavioral2/files/0x0006000000022e51-145.dat	dcrat
behavioral2/files/0x0006000000022e51-146.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
5008	Hypernet.exe
2496	explorer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	41806c88409d2cf704e9475b84b6e619.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Hypernet.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe	Hypernet.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe	Hypernet.exe
File created	C:\Program Files (x86)\Windows Portable Devices\ea9f0e6c9e2dcd	Hypernet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2828	schtasks.exe
380	schtasks.exe
2324	schtasks.exe
3488	schtasks.exe
1828	schtasks.exe
1664	schtasks.exe
4780	schtasks.exe
2968	schtasks.exe
2460	schtasks.exe
4008	schtasks.exe
3140	schtasks.exe
3808	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	41806c88409d2cf704e9475b84b6e619.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5008	Hypernet.exe
5008	Hypernet.exe
5008	Hypernet.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	Hypernet.exe
Token: SeDebugPrivilege	2496	explorer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4920	2888	41806c88409d2cf704e9475b84b6e619.exe	81
PID 2888 wrote to memory of 4920	2888	41806c88409d2cf704e9475b84b6e619.exe	81
PID 2888 wrote to memory of 4920	2888	41806c88409d2cf704e9475b84b6e619.exe	81
PID 4920 wrote to memory of 4344	4920	WScript.exe	82
PID 4920 wrote to memory of 4344	4920	WScript.exe	82
PID 4920 wrote to memory of 4344	4920	WScript.exe	82
PID 4344 wrote to memory of 5008	4344	cmd.exe	84
PID 4344 wrote to memory of 5008	4344	cmd.exe	84
PID 5008 wrote to memory of 2496	5008	Hypernet.exe	97
PID 5008 wrote to memory of 2496	5008	Hypernet.exe	97

C:\Users\Admin\AppData\Local\Temp\41806c88409d2cf704e9475b84b6e619.exe
"C:\Users\Admin\AppData\Local\Temp\41806c88409d2cf704e9475b84b6e619.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ComRefHostdll\Xv1EvtWs.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ComRefHostdll\qmdzcBrSjQ9skt6XqmW1q.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\ComRefHostdll\Hypernet.exe
      "C:\ComRefHostdll\Hypernet.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\odt\explorer.exe
        
        "C:\odt\explorer.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\ComRefHostdll\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\ComRefHostdll\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\ComRefHostdll\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hypernet.exe

Path C:\ComRefHostdll\Hypernet.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hypernet.exe

Path C:\ComRefHostdll\Hypernet.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xv1EvtWs.vbe

Path C:\ComRefHostdll\Xv1EvtWs.vbe
Size 211B
SHA256 431a40d12378998f56849be8d6ab414ae743ba1eca0cf309db0c29d768ca805c
MD5 3db176619fb401ea7debd3811ac815f6
SHA1 8c8cd48be9da03db3e00b5faff4a2aded41d139b
SHA512 ab7cf1574a77972f0efc4da3c6885ab31935a90d594ce4263507436b97687d4d4f0d0abd5734bbb0601f5d7aa45ebf7930af0c8d242ced08a7257f8f918610f7
MD5 SHA1 SHA512

Submit Download

qmdzcBrSjQ9skt6XqmW1q.bat

Path C:\ComRefHostdll\qmdzcBrSjQ9skt6XqmW1q.bat
Size 31B
SHA256 56d2234231307b7811c5d6163cdb1809f2163bfe52b6d2c022a44c5f3c5298ab
MD5 594dff98508cd34824c9819ca0f1bcf6
SHA1 99fcc393f5b51c19ac09462cf70626c4b699919a
SHA512 34a42e4df5d0eb4953c28314b1f8e472d5d187c94d8baa602eaacc0e9286334f08b0eb0d88755e9b6179663f0f0fc6eed07a11aae2bba2dd79221c10ae0f14af
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\odt\explorer.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\odt\explorer.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2496-151-0x00007FFA43EF0000-0x00007FFA449B1000-memory.dmp

Download

memory/2496-150-0x00007FFA43EF0000-0x00007FFA449B1000-memory.dmp

Download

memory/2496-147-0x00007FFA43EF0000-0x00007FFA449B1000-memory.dmp

Download

memory/5008-142-0x000000001CDF0000-0x000000001D318000-memory.dmp

Download

memory/5008-143-0x00007FFA43EF0000-0x00007FFA449B1000-memory.dmp

Download

memory/5008-148-0x00007FFA43EF0000-0x00007FFA449B1000-memory.dmp

Download

memory/5008-149-0x00007FFA43EF0000-0x00007FFA449B1000-memory.dmp

Download

memory/5008-141-0x000000001B120000-0x000000001B170000-memory.dmp

Download

memory/5008-140-0x00000000003F0000-0x000000000052E000-memory.dmp

Download