dcrat | 188ede1d0aebcbd326e9d7109e708e38b655134f0dcf3cb837e2446336aaeab7

Analysis

max time kernel
72s
max time network
68s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84a806f02be2afa43787fa8654e4bf94.exe
Size 1.9MB
Sample221027-qsdnescdak
SHA256 188ede1d0aebcbd326e9d7109e708e38b655134f0dcf3cb837e2446336aaeab7
MD5 84a806f02be2afa43787fa8654e4bf94
SHA1 e03aa103f4a43b7d5c50c56ecc61f3e5d5640d7b
SHA512 7cd08b17f834ed72b93239500525b713d4c2ac9b6f3d3402a04d556771fc8d5cf33d15da308bd9ef2d83f4e0615dafe1fab7bf4be59c3accff05290735fbc5d7
SSDEEP 49152:ZFfvXhy2aueloCfPnVlySVn7Z8nBsTYgAXc+jU9Gv:ZFXXhalloCHV7nKHg0cgU9G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/976-62-0x0000000000400000-0x0000000000564000-memory.dmp	dcrat
behavioral1/memory/976-64-0x0000000000400000-0x0000000000564000-memory.dmp	dcrat
behavioral1/memory/976-66-0x0000000000400000-0x0000000000564000-memory.dmp	dcrat
behavioral1/memory/976-65-0x0000000000400000-0x0000000000564000-memory.dmp	dcrat
behavioral1/memory/976-67-0x000000000055B97E-mapping.dmp	dcrat
behavioral1/memory/976-69-0x0000000000400000-0x0000000000564000-memory.dmp	dcrat
behavioral1/memory/976-71-0x0000000000400000-0x0000000000564000-memory.dmp	dcrat

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe
976	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	RegSvcs.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 1980 wrote to memory of 976	1980	84a806f02be2afa43787fa8654e4bf94.exe	28
PID 976 wrote to memory of 436	976	RegSvcs.exe	30
PID 976 wrote to memory of 436	976	RegSvcs.exe	30
PID 976 wrote to memory of 436	976	RegSvcs.exe	30
PID 976 wrote to memory of 436	976	RegSvcs.exe	30
PID 436 wrote to memory of 1728	436	cmd.exe	32
PID 436 wrote to memory of 1728	436	cmd.exe	32
PID 436 wrote to memory of 1728	436	cmd.exe	32
PID 436 wrote to memory of 1728	436	cmd.exe	32
PID 1728 wrote to memory of 1816	1728	w32tm.exe	33
PID 1728 wrote to memory of 1816	1728	w32tm.exe	33
PID 1728 wrote to memory of 1816	1728	w32tm.exe	33
PID 1728 wrote to memory of 1816	1728	w32tm.exe	33

C:\Users\Admin\AppData\Local\Temp\84a806f02be2afa43787fa8654e4bf94.exe
"C:\Users\Admin\AppData\Local\Temp\84a806f02be2afa43787fa8654e4bf94.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\f484IvWXUL.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1728
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f484IvWXUL.bat

Path C:\Users\Admin\AppData\Local\Temp\f484IvWXUL.bat
Size 226B
SHA256 3bfec39a3a59dae2dffc28f37ca98f90b3f2acab9a88e48b6f42b1596bec221f
MD5 ee5f6a8945776261ac76d66cb74da296
SHA1 af64a08561e19282d4afe40f8ec572e0a727808c
SHA512 47bc6528d4541227ac0a0e76c60b74f0c502dc6d6ebc7951d3942d3a911a9fc81d143887055144b5edfbd5273d7f335113c9815f1d8ec16c2b0f7f1f7133f090
MD5 SHA1 SHA512

Submit Download

memory/976-65-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/976-71-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/976-77-0x00000000007A0000-0x00000000007AE000-memory.dmp

Download

memory/976-59-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/976-60-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/976-62-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/976-64-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/976-66-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/976-76-0x0000000000740000-0x0000000000752000-memory.dmp

Download

memory/976-69-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/976-75-0x0000000000720000-0x0000000000730000-memory.dmp

Download

memory/976-73-0x00000000006D0000-0x00000000006EC000-memory.dmp

Download

memory/976-74-0x00000000006F0000-0x0000000000706000-memory.dmp

Download

memory/1980-57-0x0000000005630000-0x000000000579E000-memory.dmp

Download

memory/1980-54-0x0000000001050000-0x0000000001238000-memory.dmp

Download

memory/1980-58-0x000000000ADE0000-0x000000000AF44000-memory.dmp

Download

memory/1980-56-0x0000000000410000-0x0000000000430000-memory.dmp

Download

memory/1980-55-0x0000000075831000-0x0000000075833000-memory.dmp

Download