dcrat | 29b84cbec0c92620955afd16358fb786df50fdc6dc024399cc9d2f5d8f40f38a | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2023 19:03

Sharing

Report Analysis Logs

General

Target

LoaderB.exe
Size

1.1MB
MD5

97fd39727f09d456c6e6e8a3fb9b4028
SHA1

f27399f10573bb39ebc472b7fdfa649e48494dfd
SHA256

29b84cbec0c92620955afd16358fb786df50fdc6dc024399cc9d2f5d8f40f38a
SHA512

275a115ce4bb2662658a6d6ad77a3a83005d66d9d773726581ead4f38bf45b9e6c5d98501cfc0ec3c2623b04635856ca303ee89c7ec114ab01268741928f9a46
SSDEEP

24576:qGlFYoq77FED1/LTeXGVFkz/EaQON6uZvRbXiPoUg:HFf+6DNiwaT08XiPoUg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

Processes:

resource	yara_rule
behavioral2/memory/4404-133-0x0000000000400000-0x0000000000456000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

LoaderB.exe

description pid process target process

PID 5056 set thread context of 4404 5056 LoaderB.exe AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

AppLaunch.exe

pid	process
4404	AppLaunch.exe
4404	AppLaunch.exe
4404	AppLaunch.exe
4404	AppLaunch.exe
4404	AppLaunch.exe
4404	AppLaunch.exe
4404	AppLaunch.exe
4404	AppLaunch.exe
4404	AppLaunch.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AppLaunch.exe

pid process

4404 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 4404 AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

LoaderB.exe

description	pid	process	target process
PID 5056 wrote to memory of 4404	5056	LoaderB.exe	AppLaunch.exe
PID 5056 wrote to memory of 4404	5056	LoaderB.exe	AppLaunch.exe
PID 5056 wrote to memory of 4404	5056	LoaderB.exe	AppLaunch.exe
PID 5056 wrote to memory of 4404	5056	LoaderB.exe	AppLaunch.exe
PID 5056 wrote to memory of 4404	5056	LoaderB.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\LoaderB.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderB.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4404-132-0x0000000000000000-mapping.dmp

Download
memory/4404-133-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4404-138-0x00000000062D0000-0x0000000006874000-memory.dmp

Filesize
5.6MB

Download
memory/4404-139-0x0000000006BA0000-0x0000000006C32000-memory.dmp

Filesize
584KB

Download
memory/4404-140-0x0000000006DB0000-0x0000000006E16000-memory.dmp

Filesize
408KB

Download