dcrat | 05a3a5b64599cc2660968b37868008bb805780f0bfae9b6147879a6461d9a3fd

Resubmissions

24-11-2022 07:55

221124-jr5l7aaa53 10

24-11-2022 07:50

221124-jprmjscg2t 10

Analysis

max time kernel
130s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe
Size

1.1MB
MD5

b478d340a787b85e086cc951d0696cb1
SHA1

563d9f1b35b4898d16aff1dccd8969299f7ab8b7
SHA256

8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95
SHA512

93c5a3010ae7bf41ad966902aeaa32e17faa0bad3e76248e2096478af5bf169f817c6914a775efc666967a425716609099be8bf69e2900613a65791e4fcd3e09
SSDEEP

24576:npe9a9aC/qF5EZNo9DzDn07bPVICwUmmHcexxnn:pwa9a9F54qH075kUmmHxx1n

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Executes dropped EXE 6 IoCs

Processes:

mnb.exefsdffc.exedfsds.exedaaca.exedal.exesvchost.exe

pid process

4976 mnb.exe
1160 fsdffc.exe
1060 dfsds.exe
4632 daaca.exe
3020 dal.exe
2460 svchost.exe

pid	process
4976	mnb.exe
1160	fsdffc.exe
1060	dfsds.exe
4632	daaca.exe
3020	dal.exe
2460	svchost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mnb.exedfsds.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	mnb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	dfsds.exe

Drops startup file 2 IoCs

Processes:

dfsds.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dotNET.lnk	dfsds.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sysdll32.lnk	dfsds.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dfsds.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wininit = "C:\\Sysdll32.lnk"	dfsds.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scrss = "C:\\Users\\Admin\\AppData\\Roaming\\dotNET.lnk"	dfsds.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

70 ipinfo.io
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1452 4632 WerFault.exe daaca.exe

flow	ioc
70	ipinfo.io

pid	pid_target	process	target process
1452	4632	WerFault.exe	daaca.exe

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\dal.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\dal.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\dal.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\dal.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fsdffc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fsdffc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	fsdffc.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

daaca.exedfsds.exesvchost.exe

pid	process
4632	daaca.exe
4632	daaca.exe
1060	dfsds.exe
1060	dfsds.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe
2460	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3080 Explorer.EXE

pid	process
3080	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

daaca.exedfsds.exeExplorer.EXEsvchost.exe

description	pid	process
Token: SeDebugPrivilege	4632	daaca.exe
Token: SeDebugPrivilege	1060	dfsds.exe
Token: SeShutdownPrivilege	3080	Explorer.EXE
Token: SeCreatePagefilePrivilege	3080	Explorer.EXE
Token: SeShutdownPrivilege	3080	Explorer.EXE
Token: SeCreatePagefilePrivilege	3080	Explorer.EXE
Token: SeDebugPrivilege	2460	svchost.exe
Token: SeShutdownPrivilege	3080	Explorer.EXE
Token: SeCreatePagefilePrivilege	3080	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exemnb.exedaaca.exedfsds.exe

description	pid	process	target process
PID 532 wrote to memory of 4976	532	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	mnb.exe
PID 532 wrote to memory of 4976	532	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	mnb.exe
PID 532 wrote to memory of 4976	532	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	mnb.exe
PID 4976 wrote to memory of 1160	4976	mnb.exe	fsdffc.exe
PID 4976 wrote to memory of 1160	4976	mnb.exe	fsdffc.exe
PID 4976 wrote to memory of 1160	4976	mnb.exe	fsdffc.exe
PID 4976 wrote to memory of 1060	4976	mnb.exe	dfsds.exe
PID 4976 wrote to memory of 1060	4976	mnb.exe	dfsds.exe
PID 4976 wrote to memory of 4632	4976	mnb.exe	daaca.exe
PID 4976 wrote to memory of 4632	4976	mnb.exe	daaca.exe
PID 4976 wrote to memory of 4632	4976	mnb.exe	daaca.exe
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 4632 wrote to memory of 3080	4632	daaca.exe	Explorer.EXE
PID 532 wrote to memory of 3020	532	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	dal.exe
PID 532 wrote to memory of 3020	532	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	dal.exe
PID 532 wrote to memory of 3020	532	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	dal.exe
PID 1060 wrote to memory of 2460	1060	dfsds.exe	svchost.exe
PID 1060 wrote to memory of 2460	1060	dfsds.exe	svchost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Users\Admin\AppData\Local\Temp\8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe
"C:\Users\Admin\AppData\Local\Temp\8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:532

C:\Users\Admin\AppData\Local\Temp\mnb.exe
"C:\Users\Admin\AppData\Local\Temp\mnb.exe" -s -psfghrykjrsetdrfhjryuygs
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4976

C:\Users\Admin\AppData\Roaming\fsdffc.exe
"C:\Users\Admin\AppData\Roaming\fsdffc.exe"
4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1160

C:\Users\Admin\AppData\Roaming\dfsds.exe
"C:\Users\Admin\AppData\Roaming\dfsds.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Users\Admin\AppData\Roaming\daaca.exe
"C:\Users\Admin\AppData\Roaming\daaca.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 148
5⤵
- Program crash
PID:1452

C:\Users\Admin\AppData\Local\Temp\dal.exe
"C:\Users\Admin\AppData\Local\Temp\dal.exe"
3⤵
- Executes dropped EXE
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4632 -ip 4632
1⤵
PID:1268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dal.exe
Filesize
35KB

MD5
69947fc31894cd78ea651768721e26fa

SHA1
8f1d431dc0e082e29b8e420df9063737c56d6600

SHA256
2e16065cb223473d0891696e8bed97c240baad32d66c71a9c35b3f2faa1c02b7

SHA512
d1ebb7427a16201f827c918798e9c90a278b936846459f01ad09f4f095989792260cfab243f3a3655db2784a4a979f9badfd57462d0e7aa233f8c7f83a5fd1f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\dal.exe
Filesize
35KB

MD5
69947fc31894cd78ea651768721e26fa

SHA1
8f1d431dc0e082e29b8e420df9063737c56d6600

SHA256
2e16065cb223473d0891696e8bed97c240baad32d66c71a9c35b3f2faa1c02b7

SHA512
d1ebb7427a16201f827c918798e9c90a278b936846459f01ad09f4f095989792260cfab243f3a3655db2784a4a979f9badfd57462d0e7aa233f8c7f83a5fd1f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\mnb.exe
Filesize
1.2MB

MD5
8d44f882db1ce5ec780096bd698cadeb

SHA1
5eb4589f28d054befe40750a7c54de8a6f1bd0fa

SHA256
103df9101017558d967a8d246739520b7024a930319c3352278c19298ec6084e

SHA512
f97ccc467096023d704a4761c253ac73ed9bd3173cf1b7734b3cc6433e53f9e26393b30922c6836349a834ce8293c8b55c742a2be3f89cef42f5d2e8473347e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mnb.exe
Filesize
1.2MB

MD5
8d44f882db1ce5ec780096bd698cadeb

SHA1
5eb4589f28d054befe40750a7c54de8a6f1bd0fa

SHA256
103df9101017558d967a8d246739520b7024a930319c3352278c19298ec6084e

SHA512
f97ccc467096023d704a4761c253ac73ed9bd3173cf1b7734b3cc6433e53f9e26393b30922c6836349a834ce8293c8b55c742a2be3f89cef42f5d2e8473347e7

Download Submit
C:\Users\Admin\AppData\Roaming\daaca.exe
Filesize
415KB

MD5
dda23435a7b21721ba96ae7fb9812e20

SHA1
2e179d2f38f04879d249aac505ec05e99efbe6aa

SHA256
521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6

SHA512
b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce

Download Submit
C:\Users\Admin\AppData\Roaming\daaca.exe
Filesize
415KB

MD5
dda23435a7b21721ba96ae7fb9812e20

SHA1
2e179d2f38f04879d249aac505ec05e99efbe6aa

SHA256
521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6

SHA512
b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce

Download Submit
C:\Users\Admin\AppData\Roaming\dfsds.exe
Filesize
1.2MB

MD5
047af34af65efd5c6ee38eb7ad100a01

SHA1
61809e8f559b27e72a603a45a53116327845dbeb

SHA256
931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d

SHA512
7e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d

Download Submit
C:\Users\Admin\AppData\Roaming\dfsds.exe
Filesize
1.2MB

MD5
047af34af65efd5c6ee38eb7ad100a01

SHA1
61809e8f559b27e72a603a45a53116327845dbeb

SHA256
931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d

SHA512
7e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d

Download Submit
C:\Users\Admin\AppData\Roaming\fsdffc.exe
Filesize
48KB

MD5
f12bdda1f8ea3816740ba7a81df1e92e

SHA1
7e8f561c66e76868d2145029f71fd6ed8bc3dd50

SHA256
d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273

SHA512
f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb

Download Submit
C:\Users\Admin\AppData\Roaming\fsdffc.exe
Filesize
48KB

MD5
f12bdda1f8ea3816740ba7a81df1e92e

SHA1
7e8f561c66e76868d2145029f71fd6ed8bc3dd50

SHA256
d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273

SHA512
f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
1.2MB

MD5
047af34af65efd5c6ee38eb7ad100a01

SHA1
61809e8f559b27e72a603a45a53116327845dbeb

SHA256
931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d

SHA512
7e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
1.2MB

MD5
047af34af65efd5c6ee38eb7ad100a01

SHA1
61809e8f559b27e72a603a45a53116327845dbeb

SHA256
931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d

SHA512
7e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d

Download Submit
memory/1060-161-0x00007FFFF15F0000-0x00007FFFF20B1000-memory.dmp

Filesize
10.8MB

Download
memory/1060-140-0x0000000000000000-mapping.dmp

Download
memory/1060-146-0x000001B7356F0000-0x000001B735820000-memory.dmp

Filesize
1.2MB

Download
memory/1060-148-0x00007FFFF15F0000-0x00007FFFF20B1000-memory.dmp

Filesize
10.8MB

Download
memory/1060-147-0x000001B7374D0000-0x000001B737546000-memory.dmp

Filesize
472KB

Download
memory/1060-151-0x00007FFFF15F0000-0x00007FFFF20B1000-memory.dmp

Filesize
10.8MB

Download
memory/1060-157-0x000001B7374A0000-0x000001B7374BE000-memory.dmp

Filesize
120KB

Download
memory/1160-138-0x0000000000000000-mapping.dmp

Download
memory/2460-158-0x0000000000000000-mapping.dmp

Download
memory/2460-162-0x00007FFFF15F0000-0x00007FFFF20B1000-memory.dmp

Filesize
10.8MB

Download
memory/2460-164-0x00007FFFF15F0000-0x00007FFFF20B1000-memory.dmp

Filesize
10.8MB

Download
memory/3020-153-0x0000000000000000-mapping.dmp

Download
memory/3080-149-0x0000000001110000-0x000000000112A000-memory.dmp

Filesize
104KB

Download
memory/4632-152-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4632-150-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4632-143-0x0000000000000000-mapping.dmp

Download
memory/4632-163-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4976-135-0x0000000000000000-mapping.dmp

Download