dcrat | faa426705d165290c5748fbd2d6022a4e269d704fb6dbb24d0167aea0741c3b8

Analysis

max time kernel
66s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe
Size 2.3MB
Sample221024-wlymxaaaak
SHA256 faa426705d165290c5748fbd2d6022a4e269d704fb6dbb24d0167aea0741c3b8
MD5 7a3673360005748ae7855199875ffd75
SHA1 48a43a28451d85a04b6337e49a7c2a5fa026664e
SHA512 ef9366353f40f17986890e476c0ed4696177c8f710399b1fb8776cf4e5ba97dead2907778812a0305bbbe8e57b235d5c8a16e20af1683f9f82c3fb43d7c6656f
SSDEEP 49152:XkIOEDTD5PrzrO1FzQBt14rs/IiijcRLsc/sDBDf463fF:XlTlQrViijc9/sVDf463N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	176	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	204	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	644	schtasks.exe	62

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4880-132-0x0000000000460000-0x00000000006B2000-memory.dmp	dcrat
behavioral2/files/0x000400000001da04-141.dat	dcrat
behavioral2/files/0x000400000001da04-142.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3560	fontdrvhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\5b884080fd4f94	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\RemotePackages\RemoteDesktops\Idle.exe	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\6ccacd8608530f	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2000	schtasks.exe
3184	schtasks.exe
2984	schtasks.exe
1536	schtasks.exe
176	schtasks.exe
1880	schtasks.exe
4676	schtasks.exe
1180	schtasks.exe
2200	schtasks.exe
2604	schtasks.exe
1788	schtasks.exe
204	schtasks.exe
3852	schtasks.exe
4488	schtasks.exe
4496	schtasks.exe
3764	schtasks.exe
2612	schtasks.exe
804	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe
3560	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe
Token: SeDebugPrivilege	3560	fontdrvhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1276	4880	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe	99
PID 4880 wrote to memory of 1276	4880	FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe	99
PID 1276 wrote to memory of 3940	1276	cmd.exe	101
PID 1276 wrote to memory of 3940	1276	cmd.exe	101
PID 1276 wrote to memory of 3560	1276	cmd.exe	106
PID 1276 wrote to memory of 3560	1276	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe
"C:\Users\Admin\AppData\Local\Temp\FAA426705D165290C5748FBD2D6022A4E269D704FB6DB.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DOqEhNOD4p.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3940
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\odt\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\RemotePackages\RemoteDesktops\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe
Size 2.3MB
SHA256 faa426705d165290c5748fbd2d6022a4e269d704fb6dbb24d0167aea0741c3b8
MD5 7a3673360005748ae7855199875ffd75
SHA1 48a43a28451d85a04b6337e49a7c2a5fa026664e
SHA512 ef9366353f40f17986890e476c0ed4696177c8f710399b1fb8776cf4e5ba97dead2907778812a0305bbbe8e57b235d5c8a16e20af1683f9f82c3fb43d7c6656f
SSDEEP 49152:XkIOEDTD5PrzrO1FzQBt14rs/IiijcRLsc/sDBDf463fF:XlTlQrViijc9/sVDf463N
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontdrvhost.exe

Path C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fontdrvhost.exe
Size 2.3MB
SHA256 faa426705d165290c5748fbd2d6022a4e269d704fb6dbb24d0167aea0741c3b8
MD5 7a3673360005748ae7855199875ffd75
SHA1 48a43a28451d85a04b6337e49a7c2a5fa026664e
SHA512 ef9366353f40f17986890e476c0ed4696177c8f710399b1fb8776cf4e5ba97dead2907778812a0305bbbe8e57b235d5c8a16e20af1683f9f82c3fb43d7c6656f
SSDEEP 49152:XkIOEDTD5PrzrO1FzQBt14rs/IiijcRLsc/sDBDf463fF:XlTlQrViijc9/sVDf463N
MD5 SHA1 SHA512 SSDEEP

Submit Download

DOqEhNOD4p.bat

Path C:\Users\Admin\AppData\Local\Temp\DOqEhNOD4p.bat
Size 243B
SHA256 72697d7718a4f7600a755621f415cd31cbb86daf5ea5f00bc8cff85c99b96843
MD5 4225704c843ee9194460215451efa862
SHA1 9e67022d4c4c998355442dd4f3450de42b3e2eb7
SHA512 1a1c502f7bbc02941f8008cde9300e0e140de27765423e95f4511da04b34b406d81e45457ebff3f84b5943ad523b202e16348322c0ba269b2b62575c952d8f5a
MD5 SHA1 SHA512

Submit Download

memory/3560-144-0x00007FFA673E0000-0x00007FFA67EA1000-memory.dmp

Download

memory/3560-143-0x00007FFA673E0000-0x00007FFA67EA1000-memory.dmp

Download

memory/4880-135-0x000000001CF60000-0x000000001D488000-memory.dmp

Download

memory/4880-139-0x00007FFA67920000-0x00007FFA683E1000-memory.dmp

Download

memory/4880-132-0x0000000000460000-0x00000000006B2000-memory.dmp

Download

memory/4880-134-0x000000001B2B0000-0x000000001B300000-memory.dmp

Download

memory/4880-133-0x00007FFA67920000-0x00007FFA683E1000-memory.dmp

Download