dcrat | 188ede1d0aebcbd326e9d7109e708e38b655134f0dcf3cb837e2446336aaeab7

Analysis

max time kernel
91s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84a806f02be2afa43787fa8654e4bf94.exe
Size 1.9MB
Sample221027-qsdnescdak
SHA256 188ede1d0aebcbd326e9d7109e708e38b655134f0dcf3cb837e2446336aaeab7
MD5 84a806f02be2afa43787fa8654e4bf94
SHA1 e03aa103f4a43b7d5c50c56ecc61f3e5d5640d7b
SHA512 7cd08b17f834ed72b93239500525b713d4c2ac9b6f3d3402a04d556771fc8d5cf33d15da308bd9ef2d83f4e0615dafe1fab7bf4be59c3accff05290735fbc5d7
SSDEEP 49152:ZFfvXhy2aueloCfPnVlySVn7Z8nBsTYgAXc+jU9Gv:ZFXXhalloCHV7nKHg0cgU9G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2812-140-0x0000000000400000-0x0000000000564000-memory.dmp	dcrat

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4316 set thread context of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4316	84a806f02be2afa43787fa8654e4bf94.exe
4316	84a806f02be2afa43787fa8654e4bf94.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe
2812	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	84a806f02be2afa43787fa8654e4bf94.exe
Token: SeDebugPrivilege	2812	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 404	4316	84a806f02be2afa43787fa8654e4bf94.exe	90
PID 4316 wrote to memory of 404	4316	84a806f02be2afa43787fa8654e4bf94.exe	90
PID 4316 wrote to memory of 404	4316	84a806f02be2afa43787fa8654e4bf94.exe	90
PID 4316 wrote to memory of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91
PID 4316 wrote to memory of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91
PID 4316 wrote to memory of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91
PID 4316 wrote to memory of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91
PID 4316 wrote to memory of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91
PID 4316 wrote to memory of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91
PID 4316 wrote to memory of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91
PID 4316 wrote to memory of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91
PID 4316 wrote to memory of 2812	4316	84a806f02be2afa43787fa8654e4bf94.exe	91
PID 2812 wrote to memory of 1972	2812	RegSvcs.exe	93
PID 2812 wrote to memory of 1972	2812	RegSvcs.exe	93
PID 2812 wrote to memory of 1972	2812	RegSvcs.exe	93
PID 1972 wrote to memory of 4376	1972	cmd.exe	95
PID 1972 wrote to memory of 4376	1972	cmd.exe	95
PID 1972 wrote to memory of 4376	1972	cmd.exe	95
PID 4376 wrote to memory of 4740	4376	w32tm.exe	96
PID 4376 wrote to memory of 4740	4376	w32tm.exe	96

C:\Users\Admin\AppData\Local\Temp\84a806f02be2afa43787fa8654e4bf94.exe
"C:\Users\Admin\AppData\Local\Temp\84a806f02be2afa43787fa8654e4bf94.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wXqQ0SQmSP.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4376
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:4740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wXqQ0SQmSP.bat

Path C:\Users\Admin\AppData\Local\Temp\wXqQ0SQmSP.bat
Size 226B
SHA256 61d5c3b12b824ce5668b3570337ab038e23e388daf69be2140b48632a29eb5d2
MD5 bd893471380ca522b8420807a8521db7
SHA1 ebb0494b41a6e5281d6e49444087b516e993cffd
SHA512 c81a6d528f353c600dffd6b898210b8dcf51ba739368b7594823204040e0ad42651ae0be02016ccdba2c4117e6e161b1388a9287323fc03cbe901e8de5a1febe
MD5 SHA1 SHA512

Submit Download

memory/2812-140-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/2812-141-0x0000000005EC0000-0x0000000005F10000-memory.dmp

Download

memory/2812-142-0x0000000007DD0000-0x00000000082FC000-memory.dmp

Download

memory/2812-143-0x00000000078A0000-0x0000000007906000-memory.dmp

Download

memory/4316-136-0x0000000004C80000-0x0000000004C8A000-memory.dmp

Download

memory/4316-137-0x0000000004DC0000-0x0000000004E16000-memory.dmp

Download

memory/4316-135-0x0000000004D20000-0x0000000004DB2000-memory.dmp

Download

memory/4316-132-0x0000000000040000-0x0000000000228000-memory.dmp

Download

memory/4316-134-0x0000000005230000-0x00000000057D4000-memory.dmp

Download

memory/4316-133-0x0000000004BE0000-0x0000000004C7C000-memory.dmp

Download