dcrat | c48b6c5b3bad17a697498863f33b6d468a77af2b9cab8b9c3896f8b074ff8ea5

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2022, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2319631faa7db84404af61224fafdc8a.exe
Size 313KB
Sample221230-c3kmtsaa8t
SHA256 c48b6c5b3bad17a697498863f33b6d468a77af2b9cab8b9c3896f8b074ff8ea5
MD5 2319631faa7db84404af61224fafdc8a
SHA1 645c92f13273abab3a0e9cf6b96e8a813928f4ad
SHA512 7f8a842daa3a39e9e0b142ba3778756d85057cfd41f9f07289c02dd75a7d3ebcc0cce0d1a06456086e3f4acb7823cc3cf9283fc7d4810dd1c86c827103c42da7
SSDEEP 3072:HCkSLGiK5x45U7JLuqhlfaMmqoM0Hp7G6BB+g0or3roENrOKbIxe01Cz5Mqdqujr:yLGzlKWpm4QpqCB/riyIxZ1WqqdS49
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat smokeloader backdoor infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/2348-133-0x0000000002190000-0x0000000002199000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/5080-159-0x0000000000760000-0x00000000007B6000-memory.dmp	dcrat

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
4536	3577.exe
4952	3CEB.exe
2152	3F7C.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 5080	2152	3F7C.exe	102

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2319631faa7db84404af61224fafdc8a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2319631faa7db84404af61224fafdc8a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2319631faa7db84404af61224fafdc8a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2348	2319631faa7db84404af61224fafdc8a.exe
2348	2319631faa7db84404af61224fafdc8a.exe
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2864	Process not Found
5080	AppLaunch.exe

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
2348	2319631faa7db84404af61224fafdc8a.exe
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeDebugPrivilege	5080	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4536	2864	Process not Found	89
PID 2864 wrote to memory of 4536	2864	Process not Found	89
PID 2864 wrote to memory of 4536	2864	Process not Found	89
PID 2864 wrote to memory of 4952	2864	Process not Found	90
PID 2864 wrote to memory of 4952	2864	Process not Found	90
PID 2864 wrote to memory of 4952	2864	Process not Found	90
PID 4536 wrote to memory of 4692	4536	3577.exe	91
PID 4536 wrote to memory of 4692	4536	3577.exe	91
PID 4536 wrote to memory of 4692	4536	3577.exe	91
PID 4536 wrote to memory of 4600	4536	3577.exe	92
PID 4536 wrote to memory of 4600	4536	3577.exe	92
PID 4536 wrote to memory of 4600	4536	3577.exe	92
PID 4536 wrote to memory of 2780	4536	3577.exe	93
PID 4536 wrote to memory of 2780	4536	3577.exe	93
PID 4536 wrote to memory of 2780	4536	3577.exe	93
PID 4536 wrote to memory of 4560	4536	3577.exe	94
PID 4536 wrote to memory of 4560	4536	3577.exe	94
PID 4536 wrote to memory of 4560	4536	3577.exe	94
PID 2864 wrote to memory of 2152	2864	Process not Found	95
PID 2864 wrote to memory of 2152	2864	Process not Found	95
PID 2864 wrote to memory of 2152	2864	Process not Found	95
PID 2864 wrote to memory of 2476	2864	Process not Found	97
PID 2864 wrote to memory of 2476	2864	Process not Found	97
PID 2864 wrote to memory of 2476	2864	Process not Found	97
PID 2864 wrote to memory of 2476	2864	Process not Found	97
PID 4952 wrote to memory of 4552	4952	3CEB.exe	98
PID 4952 wrote to memory of 4552	4952	3CEB.exe	98
PID 4952 wrote to memory of 4552	4952	3CEB.exe	98
PID 4952 wrote to memory of 1008	4952	3CEB.exe	99
PID 4952 wrote to memory of 1008	4952	3CEB.exe	99
PID 4952 wrote to memory of 1008	4952	3CEB.exe	99
PID 4952 wrote to memory of 1176	4952	3CEB.exe	100
PID 4952 wrote to memory of 1176	4952	3CEB.exe	100
PID 4952 wrote to memory of 1176	4952	3CEB.exe	100
PID 4952 wrote to memory of 3624	4952	3CEB.exe	101
PID 4952 wrote to memory of 3624	4952	3CEB.exe	101
PID 4952 wrote to memory of 3624	4952	3CEB.exe	101
PID 2152 wrote to memory of 5080	2152	3F7C.exe	102
PID 2152 wrote to memory of 5080	2152	3F7C.exe	102
PID 2152 wrote to memory of 5080	2152	3F7C.exe	102
PID 2152 wrote to memory of 5080	2152	3F7C.exe	102
PID 2152 wrote to memory of 5080	2152	3F7C.exe	102
PID 2864 wrote to memory of 4972	2864	Process not Found	103
PID 2864 wrote to memory of 4972	2864	Process not Found	103
PID 2864 wrote to memory of 4972	2864	Process not Found	103
PID 2864 wrote to memory of 1796	2864	Process not Found	104
PID 2864 wrote to memory of 1796	2864	Process not Found	104
PID 2864 wrote to memory of 1796	2864	Process not Found	104
PID 2864 wrote to memory of 1796	2864	Process not Found	104
PID 2864 wrote to memory of 3064	2864	Process not Found	105
PID 2864 wrote to memory of 3064	2864	Process not Found	105
PID 2864 wrote to memory of 3064	2864	Process not Found	105
PID 2864 wrote to memory of 3456	2864	Process not Found	106
PID 2864 wrote to memory of 3456	2864	Process not Found	106
PID 2864 wrote to memory of 3456	2864	Process not Found	106
PID 2864 wrote to memory of 3456	2864	Process not Found	106
PID 2864 wrote to memory of 3592	2864	Process not Found	107
PID 2864 wrote to memory of 3592	2864	Process not Found	107
PID 2864 wrote to memory of 3592	2864	Process not Found	107
PID 2864 wrote to memory of 3592	2864	Process not Found	107
PID 2864 wrote to memory of 5056	2864	Process not Found	108
PID 2864 wrote to memory of 5056	2864	Process not Found	108
PID 2864 wrote to memory of 5056	2864	Process not Found	108
PID 2864 wrote to memory of 5056	2864	Process not Found	108

C:\Users\Admin\AppData\Local\Temp\2319631faa7db84404af61224fafdc8a.exe
"C:\Users\Admin\AppData\Local\Temp\2319631faa7db84404af61224fafdc8a.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2348

C:\Users\Admin\AppData\Local\Temp\3577.exe
C:\Users\Admin\AppData\Local\Temp\3577.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4560

C:\Users\Admin\AppData\Local\Temp\3CEB.exe
C:\Users\Admin\AppData\Local\Temp\3CEB.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3624

C:\Users\Admin\AppData\Local\Temp\3F7C.exe
C:\Users\Admin\AppData\Local\Temp\3F7C.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:5080

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2476

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4972

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1796

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3064

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3456

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3592

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5056

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3048

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3577.exe

Path C:\Users\Admin\AppData\Local\Temp\3577.exe
Size 67KB
SHA256 7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
MD5 666d8f33d37064fd5d14e2166c9bfa69
SHA1 3b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA512 ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
SSDEEP 768:ZuwmM9Vtm6I8QVGtYz2iRmjegGkA+nQ5mloCqn38vYI41M8uvVrnfvrnJ+BnBjv9:ZoeMlRU1TloBnsrnfvrnApBjLas
MD5 SHA1 SHA512 SSDEEP

Submit Download

3577.exe

Path C:\Users\Admin\AppData\Local\Temp\3577.exe
Size 67KB
SHA256 7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
MD5 666d8f33d37064fd5d14e2166c9bfa69
SHA1 3b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA512 ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
SSDEEP 768:ZuwmM9Vtm6I8QVGtYz2iRmjegGkA+nQ5mloCqn38vYI41M8uvVrnfvrnJ+BnBjv9:ZoeMlRU1TloBnsrnfvrnApBjLas
MD5 SHA1 SHA512 SSDEEP

Submit Download

3CEB.exe

Path C:\Users\Admin\AppData\Local\Temp\3CEB.exe
Size 67KB
SHA256 7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
MD5 666d8f33d37064fd5d14e2166c9bfa69
SHA1 3b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA512 ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
SSDEEP 768:ZuwmM9Vtm6I8QVGtYz2iRmjegGkA+nQ5mloCqn38vYI41M8uvVrnfvrnJ+BnBjv9:ZoeMlRU1TloBnsrnfvrnApBjLas
MD5 SHA1 SHA512 SSDEEP

Submit Download

3CEB.exe

Path C:\Users\Admin\AppData\Local\Temp\3CEB.exe
Size 67KB
SHA256 7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
MD5 666d8f33d37064fd5d14e2166c9bfa69
SHA1 3b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA512 ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
SSDEEP 768:ZuwmM9Vtm6I8QVGtYz2iRmjegGkA+nQ5mloCqn38vYI41M8uvVrnfvrnJ+BnBjv9:ZoeMlRU1TloBnsrnfvrnApBjLas
MD5 SHA1 SHA512 SSDEEP

Submit Download

3F7C.exe

Path C:\Users\Admin\AppData\Local\Temp\3F7C.exe
Size 377KB
SHA256 da91a24df14a5619afba2f2ab9e1939d5d74f7362d5b3bd9f9647ddae825f10d
MD5 dc42bbb02be38790863749867fc75344
SHA1 1df316c0abdbcfa58da1d6939e4d9d2c39588b97
SHA512 006d8728c2b9c24e35a1ec5cbeb4f8f0a2094d6e025ff1cdcf00995b4b15c4c3abcf8e433de39e5e33589482ef7c7362b11a900b599c6c93d8f796c1647e3b86
SSDEEP 6144:zL6heVCbNLX0m8bTXORcXon/4pBlsLE8JI7PvjkBuBBMki:zGe8NLXx8bTXmcXAI7Dkfki
MD5 SHA1 SHA512 SSDEEP

Submit Download

3F7C.exe

Path C:\Users\Admin\AppData\Local\Temp\3F7C.exe
Size 377KB
SHA256 da91a24df14a5619afba2f2ab9e1939d5d74f7362d5b3bd9f9647ddae825f10d
MD5 dc42bbb02be38790863749867fc75344
SHA1 1df316c0abdbcfa58da1d6939e4d9d2c39588b97
SHA512 006d8728c2b9c24e35a1ec5cbeb4f8f0a2094d6e025ff1cdcf00995b4b15c4c3abcf8e433de39e5e33589482ef7c7362b11a900b599c6c93d8f796c1647e3b86
SSDEEP 6144:zL6heVCbNLX0m8bTXORcXon/4pBlsLE8JI7PvjkBuBBMki:zGe8NLXx8bTXmcXAI7Dkfki
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1388-198-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Download

memory/1388-188-0x0000000000DD0000-0x0000000000DDB000-memory.dmp

Download

memory/1388-187-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Download

memory/1796-170-0x0000000000DD0000-0x0000000000DD9000-memory.dmp

Download

memory/1796-169-0x0000000000DE0000-0x0000000000DE5000-memory.dmp

Download

memory/1796-192-0x0000000000DE0000-0x0000000000DE5000-memory.dmp

Download

memory/2348-134-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/2348-133-0x0000000002190000-0x0000000002199000-memory.dmp

Download

memory/2348-132-0x0000000000608000-0x000000000061E000-memory.dmp

Download

memory/2348-135-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/2476-152-0x0000000000560000-0x0000000000567000-memory.dmp

Download

memory/2476-153-0x0000000000550000-0x000000000055B000-memory.dmp

Download

memory/2476-190-0x0000000000560000-0x0000000000567000-memory.dmp

Download

memory/3048-197-0x0000000000E00000-0x0000000000E07000-memory.dmp

Download

memory/3048-185-0x0000000000BF0000-0x0000000000BFD000-memory.dmp

Download

memory/3048-184-0x0000000000E00000-0x0000000000E07000-memory.dmp

Download

memory/3064-193-0x0000000000700000-0x0000000000706000-memory.dmp

Download

memory/3064-173-0x00000000006F0000-0x00000000006FC000-memory.dmp

Download

memory/3064-172-0x0000000000700000-0x0000000000706000-memory.dmp

Download

memory/3456-194-0x0000000000A40000-0x0000000000A62000-memory.dmp

Download

memory/3456-175-0x0000000000A40000-0x0000000000A62000-memory.dmp

Download

memory/3456-176-0x0000000000A10000-0x0000000000A37000-memory.dmp

Download

memory/3592-179-0x00000000010C0000-0x00000000010C9000-memory.dmp

Download

memory/3592-195-0x00000000010D0000-0x00000000010D5000-memory.dmp

Download

memory/3592-178-0x00000000010D0000-0x00000000010D5000-memory.dmp

Download

memory/4536-139-0x0000000000B70000-0x0000000000B86000-memory.dmp

Download

memory/4536-140-0x0000000005390000-0x00000000053F6000-memory.dmp

Download

memory/4972-166-0x0000000000530000-0x0000000000539000-memory.dmp

Download

memory/4972-191-0x0000000000530000-0x0000000000539000-memory.dmp

Download

memory/4972-167-0x0000000000520000-0x000000000052F000-memory.dmp

Download

memory/5056-196-0x0000000000D90000-0x0000000000D96000-memory.dmp

Download

memory/5056-182-0x0000000000D80000-0x0000000000D8B000-memory.dmp

Download

memory/5056-181-0x0000000000D90000-0x0000000000D96000-memory.dmp

Download

memory/5080-189-0x0000000006100000-0x0000000006192000-memory.dmp

Download

memory/5080-165-0x0000000005870000-0x0000000005E14000-memory.dmp

Download

memory/5080-159-0x0000000000760000-0x00000000007B6000-memory.dmp

Download

memory/5080-199-0x0000000005240000-0x0000000005290000-memory.dmp

Download