dcrat | deccb4702668020e6bfc1429fe610de599a4385667e5ff2779917f49fc867ed2

General

Target

Скриншот.scr
Size

2.0MB
MD5

4130cc053051c6d837a67570ee0b014e
SHA1

0c589bfb09418dc835800d785e025866921325e0
SHA256

deccb4702668020e6bfc1429fe610de599a4385667e5ff2779917f49fc867ed2
SHA512

d18bf297ea60dc4c082a420f74302dc17306ae3ab509bc0f0c38b3691867f41563045b7faed1972efb82738d5b5f02e056574136e3de29a866e6dcde7544621d
SSDEEP

49152:1bA3gTuxSrTiMusYHYm07yKo4fl8ykl+jELqdFVdhhr:1biwiMs07yK1li+jwqX/hh

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/2288-141-0x00000000007D0000-0x0000000000BF2000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

Processes:

work.exedfesa.exe

pid process

1696 work.exe
2288 dfesa.exe

pid	process
1696	work.exe
2288	dfesa.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

work.exeСкриншот.scr

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	work.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Скриншот.scr

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

dfesa.exe

pid	process
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

dfesa.exe

pid	process
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe
2288	dfesa.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dfesa.exe

pid process

2288 dfesa.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dfesa.exe

description pid process

Token: SeDebugPrivilege 2288 dfesa.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dfesa.exe

pid process

2288 dfesa.exe

description	pid	process
Token: SeDebugPrivilege	2288	dfesa.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Скриншот.scrcmd.exework.exe

description	pid	process	target process
PID 3448 wrote to memory of 1952	3448	Скриншот.scr	cmd.exe
PID 3448 wrote to memory of 1952	3448	Скриншот.scr	cmd.exe
PID 3448 wrote to memory of 1952	3448	Скриншот.scr	cmd.exe
PID 1952 wrote to memory of 1696	1952	cmd.exe	work.exe
PID 1952 wrote to memory of 1696	1952	cmd.exe	work.exe
PID 1952 wrote to memory of 1696	1952	cmd.exe	work.exe
PID 1696 wrote to memory of 2288	1696	work.exe	dfesa.exe
PID 1696 wrote to memory of 2288	1696	work.exe	dfesa.exe
PID 1696 wrote to memory of 2288	1696	work.exe	dfesa.exe

C:\Users\Admin\AppData\Local\Temp\Скриншот.scr
"C:\Users\Admin\AppData\Local\Temp\Скриншот.scr" /S
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
work.exe -priverdD
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
Filesize
35B

MD5
ff59d999beb970447667695ce3273f75

SHA1
316fa09f467ba90ac34a054daf2e92e6e2854ff8

SHA256
065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

SHA512
d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
Filesize
1.8MB

MD5
eae58983f5eb271fd26d9842fd3a561a

SHA1
f3829c26b62189a953d3e753e5efbdb5d53e3aa2

SHA256
ce6670936155b4d7f8324d73711d15a028fee6f9b7c6f4262621188acf45382b

SHA512
5f5e2a2d369de07aa056f36c55e0daf633b3cec77a3bbbe7fe4eacb64ecfff0dd0f658076b6f6045e8edca63b5268349c871a194cb50fd242afabeb61da0eb0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
Filesize
1.8MB

MD5
eae58983f5eb271fd26d9842fd3a561a

SHA1
f3829c26b62189a953d3e753e5efbdb5d53e3aa2

SHA256
ce6670936155b4d7f8324d73711d15a028fee6f9b7c6f4262621188acf45382b

SHA512
5f5e2a2d369de07aa056f36c55e0daf633b3cec77a3bbbe7fe4eacb64ecfff0dd0f658076b6f6045e8edca63b5268349c871a194cb50fd242afabeb61da0eb0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
Filesize
1.4MB

MD5
a2b5b06c6892da9d79036b2ac472cbcb

SHA1
a9975118721d3189dc518740517c577bdcaadf06

SHA256
e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

SHA512
3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
Filesize
1.4MB

MD5
a2b5b06c6892da9d79036b2ac472cbcb

SHA1
a9975118721d3189dc518740517c577bdcaadf06

SHA256
e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

SHA512
3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

Download Submit
memory/1696-134-0x0000000000000000-mapping.dmp

Download
memory/1952-132-0x0000000000000000-mapping.dmp

Download
memory/2288-141-0x00000000007D0000-0x0000000000BF2000-memory.dmp

Filesize
4.1MB

Download
memory/2288-137-0x0000000000000000-mapping.dmp

Download
memory/2288-140-0x00000000007D0000-0x0000000000BF2000-memory.dmp

Filesize
4.1MB

Download
memory/2288-142-0x0000000006060000-0x0000000006604000-memory.dmp

Filesize
5.6MB

Download
memory/2288-143-0x0000000005DE0000-0x0000000005E30000-memory.dmp

Filesize
320KB

Download
memory/2288-144-0x0000000006B40000-0x000000000706C000-memory.dmp

Filesize
5.2MB

Download
memory/2288-145-0x00000000007D0000-0x0000000000BF2000-memory.dmp

Filesize
4.1MB

Download
memory/2288-146-0x0000000007550000-0x00000000075E2000-memory.dmp

Filesize
584KB

Download
memory/2288-147-0x00000000074B0000-0x0000000007516000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads