dcrat | 3d8e8ce36a6a29298846a4216ea303db369b7bfc750fcfd1028b8432abc29483

General

Target

HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
Size

1.1MB
MD5

96e7fbbe91a544face9f073d359eb4f6
SHA1

f148a329a3a8bb6bc97ccc01139a3651eef3d8bd
SHA256

3d8e8ce36a6a29298846a4216ea303db369b7bfc750fcfd1028b8432abc29483
SHA512

95448fe82c03652b3be42d4cc662c3e4760dd2ba62a8a79f45782385c5255d4f8938e1a1cbd867eeba666c948f915f8cdc9f20a44bc97d1fd03d77aa58755569
SSDEEP

24576:xKdL0OLe2/fCNK1PfW9ckdV6Yit9shid+4:gd0IvkKJH0D

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/364-54-0x0000000000020000-0x0000000000140000-memory.dmp	dcrat
C:\Users\Public\Favorites\explorer.exe	dcrat
C:\Users\Public\Favorites\explorer.exe	dcrat
behavioral1/memory/1604-65-0x0000000000370000-0x0000000000490000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

explorer.exe

pid process

1604 explorer.exe

pid	process
1604	explorer.exe

Drops file in System32 directory 4 IoCs

Processes:

HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe

description	ioc	process
File created	C:\Windows\System32\WEB\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
File created	C:\Windows\System32\wbem\auxiliarydisplaydriverlib\WmiPrvSE.exe	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
File created	C:\Windows\System32\wbem\auxiliarydisplaydriverlib\24dbde2999530ef5fd907494bc374d663924116c	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
File created	C:\Windows\System32\WEB\spoolsv.exe	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe

Drops file in Program Files directory 3 IoCs

Processes:

HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe

description	ioc	process
File created	C:\Program Files (x86)\Google\Policies\dwm.exe	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
File opened for modification	C:\Program Files (x86)\Google\Policies\dwm.exe	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
File created	C:\Program Files (x86)\Google\Policies\6cb0b6c459d5d3455a3da700e713f2e2529862ff	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1752 schtasks.exe
1664 schtasks.exe
1836 schtasks.exe
1716 schtasks.exe
1772 schtasks.exe
1988 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exeexplorer.exe

pid process

364 HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
1604 explorer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exeexplorer.exe

description pid process

Token: SeDebugPrivilege 364 HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
Token: SeDebugPrivilege 1604 explorer.exe

pid	process
1752	schtasks.exe
1664	schtasks.exe
1836	schtasks.exe
1716	schtasks.exe
1772	schtasks.exe
1988	schtasks.exe

pid	process
364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
1604	explorer.exe

description	pid	process
Token: SeDebugPrivilege	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
Token: SeDebugPrivilege	1604	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe

description	pid	process	target process
PID 364 wrote to memory of 1988	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1988	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1988	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1752	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1752	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1752	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1664	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1664	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1664	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1836	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1836	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1836	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1716	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1716	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1716	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1772	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1772	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1772	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	schtasks.exe
PID 364 wrote to memory of 1604	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	explorer.exe
PID 364 wrote to memory of 1604	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	explorer.exe
PID 364 wrote to memory of 1604	364	HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-3d8e8ce36a6a.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Policies\dwm.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\WEB\spoolsv.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\WmiPrvSE.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\PerfLogs\Admin\lsass.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1836

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Favorites\explorer.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\auxiliarydisplaydriverlib\WmiPrvSE.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1772

C:\Users\Public\Favorites\explorer.exe
"C:\Users\Public\Favorites\explorer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Favorites\explorer.exe

Filesize
1.1MB

MD5
96e7fbbe91a544face9f073d359eb4f6

SHA1
f148a329a3a8bb6bc97ccc01139a3651eef3d8bd

SHA256
3d8e8ce36a6a29298846a4216ea303db369b7bfc750fcfd1028b8432abc29483

SHA512
95448fe82c03652b3be42d4cc662c3e4760dd2ba62a8a79f45782385c5255d4f8938e1a1cbd867eeba666c948f915f8cdc9f20a44bc97d1fd03d77aa58755569

Download Submit
C:\Users\Public\Favorites\explorer.exe

Filesize
1.1MB

MD5
96e7fbbe91a544face9f073d359eb4f6

SHA1
f148a329a3a8bb6bc97ccc01139a3651eef3d8bd

SHA256
3d8e8ce36a6a29298846a4216ea303db369b7bfc750fcfd1028b8432abc29483

SHA512
95448fe82c03652b3be42d4cc662c3e4760dd2ba62a8a79f45782385c5255d4f8938e1a1cbd867eeba666c948f915f8cdc9f20a44bc97d1fd03d77aa58755569

Download Submit
memory/364-54-0x0000000000020000-0x0000000000140000-memory.dmp

Filesize
1.1MB

Download
memory/364-61-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

Filesize
8KB

Download
memory/1604-62-0x0000000000000000-mapping.dmp

Download
memory/1604-65-0x0000000000370000-0x0000000000490000-memory.dmp

Filesize
1.1MB

Download
memory/1664-57-0x0000000000000000-mapping.dmp

Download
memory/1716-59-0x0000000000000000-mapping.dmp

Download
memory/1752-56-0x0000000000000000-mapping.dmp

Download
memory/1772-60-0x0000000000000000-mapping.dmp

Download
memory/1836-58-0x0000000000000000-mapping.dmp

Download
memory/1988-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads