dcrat | 7e53cfc5aa663350d7e0aced0d7d46d358b81d0c7c0a7a09c7eeb422f3208a2c

Analysis

max time kernel
131s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2022, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06f5e7e201f516c298baa0a3f64cec71.exe
Size 1.4MB
Sample221016-bxdfwsgfc4
SHA256 7e53cfc5aa663350d7e0aced0d7d46d358b81d0c7c0a7a09c7eeb422f3208a2c
MD5 06f5e7e201f516c298baa0a3f64cec71
SHA1 260744dbda21a39d2b88be83ffaea64ab988b2a9
SHA512 e33473e1c2bb814db3357329bc0fac53ffc733b549c67f91a8f970ddd94329ba52f0c02bdf5b5182fd8eca143d96516e073d9e84cca8313d0270706d10854beb
SSDEEP 24576:n2G/nvxW3WpH8FURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n5:nbA3viYboSytY4VmdE7K5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Windows\\it-IT\\TrustedInstaller.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\WmiPrvSE.exe\""	hypernet.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	1732	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	1732	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	1732	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	1732	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	1732	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	1732	schtasks.exe	25

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000022e6f-139.dat	dcrat
behavioral2/files/0x0006000000022e6f-140.dat	dcrat
behavioral2/memory/1368-141-0x0000000000C60000-0x0000000000D8A000-memory.dmp	dcrat
behavioral2/files/0x0006000000022e80-150.dat	dcrat
behavioral2/files/0x0006000000022e80-151.dat	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
1368	hypernet.exe
4552	TrustedInstaller.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	hypernet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	06f5e7e201f516c298baa0a3f64cec71.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\odt\\WmiPrvSE.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\odt\\WmiPrvSE.exe\""	hypernet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Windows\\it-IT\\TrustedInstaller.exe\""	hypernet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Windows\\it-IT\\TrustedInstaller.exe\""	hypernet.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\msil_system.resources_b77a5c561934e089_10.0.19041.1_de-de_27081ff14d4067bb\lsass.exe	hypernet.exe
File created	C:\Windows\it-IT\TrustedInstaller.exe	hypernet.exe
File created	C:\Windows\it-IT\04c1e7795967e4	hypernet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
208	schtasks.exe
4924	schtasks.exe
3864	schtasks.exe
4800	schtasks.exe
2664	schtasks.exe
1480	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	06f5e7e201f516c298baa0a3f64cec71.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	hypernet.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4252	reg.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1368	hypernet.exe
1368	hypernet.exe
1368	hypernet.exe
1368	hypernet.exe
1368	hypernet.exe
4552	TrustedInstaller.exe
4552	TrustedInstaller.exe
4552	TrustedInstaller.exe
4552	TrustedInstaller.exe
4552	TrustedInstaller.exe
4552	TrustedInstaller.exe
4552	TrustedInstaller.exe
4552	TrustedInstaller.exe
4552	TrustedInstaller.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4552	TrustedInstaller.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	hypernet.exe
Token: SeDebugPrivilege	4552	TrustedInstaller.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4888	3692	06f5e7e201f516c298baa0a3f64cec71.exe	82
PID 3692 wrote to memory of 4888	3692	06f5e7e201f516c298baa0a3f64cec71.exe	82
PID 3692 wrote to memory of 4888	3692	06f5e7e201f516c298baa0a3f64cec71.exe	82
PID 3692 wrote to memory of 4492	3692	06f5e7e201f516c298baa0a3f64cec71.exe	83
PID 3692 wrote to memory of 4492	3692	06f5e7e201f516c298baa0a3f64cec71.exe	83
PID 3692 wrote to memory of 4492	3692	06f5e7e201f516c298baa0a3f64cec71.exe	83
PID 4888 wrote to memory of 1584	4888	WScript.exe	88
PID 4888 wrote to memory of 1584	4888	WScript.exe	88
PID 4888 wrote to memory of 1584	4888	WScript.exe	88
PID 1584 wrote to memory of 1368	1584	cmd.exe	90
PID 1584 wrote to memory of 1368	1584	cmd.exe	90
PID 1368 wrote to memory of 2476	1368	hypernet.exe	99
PID 1368 wrote to memory of 2476	1368	hypernet.exe	99
PID 2476 wrote to memory of 4752	2476	cmd.exe	101
PID 2476 wrote to memory of 4752	2476	cmd.exe	101
PID 1584 wrote to memory of 4252	1584	cmd.exe	102
PID 1584 wrote to memory of 4252	1584	cmd.exe	102
PID 1584 wrote to memory of 4252	1584	cmd.exe	102
PID 2476 wrote to memory of 4552	2476	cmd.exe	103
PID 2476 wrote to memory of 4552	2476	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\06f5e7e201f516c298baa0a3f64cec71.exe
"C:\Users\Admin\AppData\Local\Temp\06f5e7e201f516c298baa0a3f64cec71.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsHyper\hymtX7zEN4U5nshgBbRY88oEFl63P.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\MsHyper\SKFOl8fXFh.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\MsHyper\hypernet.exe
      "C:\MsHyper\hypernet.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Checks computer location settings
      Adds Run key to start application
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1368
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x0UUnFumWz.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2476
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4752
      - C:\Windows\it-IT\TrustedInstaller.exe
        
        "C:\Windows\it-IT\TrustedInstaller.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4252
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsHyper\file.vbs"
  2⤵
  PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 8 /tr "'C:\Windows\it-IT\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Windows\it-IT\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SKFOl8fXFh.bat

Path C:\MsHyper\SKFOl8fXFh.bat
Size 137B
SHA256 38a693268e38a59827c69cc3f5b3d44f8107d348e9c6c785f20d15350b85f62a
MD5 865871f22822269e24249c9c5a8a6908
SHA1 045fbdd7704d001fc44e24bd75fd296d8c953372
SHA512 04d49a92439d2c1eb50a5359b240f141aade1e836a42617bb9f038ac15062f1ee0788328655051aaa3a3ff5724c5f1cb44ada76b09c1c75460baf2f3bfc9066a
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\MsHyper\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

hymtX7zEN4U5nshgBbRY88oEFl63P.vbe

Path C:\MsHyper\hymtX7zEN4U5nshgBbRY88oEFl63P.vbe
Size 194B
SHA256 1a09a2899b741156424bea0997767d972e12c24d19fe23b44a97d43f1596b78f
MD5 e9b12e498cef9cc3900867991adb10d9
SHA1 0e99385c38aa2cc0f8314d8d28f051183687f17a
SHA512 f80980b6307a10a1882d50e1d0b088f9fcc7da8fd85e2ec199d35add9c5bf4ecd35b5f705eda05c6cb2b37ff3593fbc70dcd3548fd2ddd541c9bbe1c1abcafbd
MD5 SHA1 SHA512

Submit Download

hypernet.exe

Path C:\MsHyper\hypernet.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

hypernet.exe

Path C:\MsHyper\hypernet.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

x0UUnFumWz.bat

Path C:\Users\Admin\AppData\Local\Temp\x0UUnFumWz.bat
Size 202B
SHA256 508929ef6514f43d1a1fe111e29b02ad2bc3fb55387db75a4b29220330f45287
MD5 fbde4cb81c0f94388f871dfeea160154
SHA1 5805aadffa4c37132f4678ec0e6e8167b99129f3
SHA512 f92967eaf982c45a396b3da88666b4541c210d29277a0f95eb5318f9613ae833005da5aa58f4018e52c3a2b52785028043c7a8731dd6fb64fb3732844de49dd7
MD5 SHA1 SHA512

Submit Download

TrustedInstaller.exe

Path C:\Windows\it-IT\TrustedInstaller.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

TrustedInstaller.exe

Path C:\Windows\it-IT\TrustedInstaller.exe
Size 1.1MB
SHA256 ae1b099ce5538752b28e4ff9f982fd6580d0af74e8979c6832516f0a9792bda9
MD5 b3051c4d8552873dc3f09220b5698c1b
SHA1 1801edef53727d4cdb55d5c139b47a55f45f33e7
SHA512 d463364a87b03996468695b991365cac3007da97b9c0b082583e4684b061139d1a897e37de7585cc38ab5440d8b5fe2281a64bed92714a4af5d5adef2490093d
SSDEEP 24576:vURYbo7uyzjZiws8r2/Ypt01Sbpw7WEEq3EvjmzYd0n:UYboSytY4VmdE7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1368-141-0x0000000000C60000-0x0000000000D8A000-memory.dmp

Download

memory/1368-142-0x000000001C1E0000-0x000000001C230000-memory.dmp

Download

memory/1368-143-0x00007FFE806B0000-0x00007FFE81171000-memory.dmp

Download

memory/1368-145-0x00007FFE806B0000-0x00007FFE81171000-memory.dmp

Download

memory/4552-152-0x00007FFE806B0000-0x00007FFE81171000-memory.dmp

Download

memory/4552-153-0x00007FFE806B0000-0x00007FFE81171000-memory.dmp

Download