dcrat | b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5

General

Target

b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe
Size

381KB
MD5

d944666a3de314aa9304e02b1a5b7e8c
SHA1

8fe5dec1d2c7a9c3415378bbb398989a2f80ceed
SHA256

b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5
SHA512

49f6763fb7e7e5f798f3f747b1bfc2cd2ca710f7d4364ac2edc12db8a3cd878b6b5a70d91414b821746e68a4fd9b922487a8486d9051d9839bdd699473f0a356
SSDEEP

6144:j1gkdILtmndjOS4kfg0gooMUzNQgsrQXp6SMt8/qqDL:jjndjTFgz5QhvSMtXqn

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/3736-132-0x00000188C99B0000-0x00000188C9A18000-memory.dmp	dcrat
C:\Users\Default\dwm.exe	dcrat
C:\Users\Default User\dwm.exe	dcrat

Executes dropped EXE 1 IoCs

Processes:

dwm.exe

pid process

340 dwm.exe

pid	process
340	dwm.exe

Drops file in Program Files directory 2 IoCs

Processes:

b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe

description	ioc	process
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\System.exe	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2204 schtasks.exe
2948 schtasks.exe
5076 schtasks.exe
4988 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exedwm.exe

pid process

3736 b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe
340 dwm.exe

pid	process
2204	schtasks.exe
2948	schtasks.exe
5076	schtasks.exe
4988	schtasks.exe

pid	process
3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe
340	dwm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exedwm.exe

description	pid	process
Token: SeDebugPrivilege	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe
Token: SeDebugPrivilege	340	dwm.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe

description	pid	process	target process
PID 3736 wrote to memory of 2204	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	schtasks.exe
PID 3736 wrote to memory of 2204	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	schtasks.exe
PID 3736 wrote to memory of 2948	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	schtasks.exe
PID 3736 wrote to memory of 2948	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	schtasks.exe
PID 3736 wrote to memory of 5076	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	schtasks.exe
PID 3736 wrote to memory of 5076	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	schtasks.exe
PID 3736 wrote to memory of 4988	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	schtasks.exe
PID 3736 wrote to memory of 4988	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	schtasks.exe
PID 3736 wrote to memory of 340	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	dwm.exe
PID 3736 wrote to memory of 340	3736	b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe	dwm.exe

C:\Users\Admin\AppData\Local\Temp\b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe
"C:\Users\Admin\AppData\Local\Temp\b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Documents and Settings\SearchApp.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2204

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\System.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2948

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\dllhost.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:5076

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:4988

C:\Users\Default User\dwm.exe
"C:\Users\Default User\dwm.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Default User\dwm.exe
Filesize
381KB

MD5
d944666a3de314aa9304e02b1a5b7e8c

SHA1
8fe5dec1d2c7a9c3415378bbb398989a2f80ceed

SHA256
b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5

SHA512
49f6763fb7e7e5f798f3f747b1bfc2cd2ca710f7d4364ac2edc12db8a3cd878b6b5a70d91414b821746e68a4fd9b922487a8486d9051d9839bdd699473f0a356

Download Submit
C:\Users\Default\dwm.exe
Filesize
381KB

MD5
d944666a3de314aa9304e02b1a5b7e8c

SHA1
8fe5dec1d2c7a9c3415378bbb398989a2f80ceed

SHA256
b8a05f1b87a44a0b3180c17f00e9797c080452bea0b5cbcb8d1fbe8e39f8ebf5

SHA512
49f6763fb7e7e5f798f3f747b1bfc2cd2ca710f7d4364ac2edc12db8a3cd878b6b5a70d91414b821746e68a4fd9b922487a8486d9051d9839bdd699473f0a356

Download Submit
memory/340-138-0x0000000000000000-mapping.dmp

Download
memory/340-142-0x00007FF984A20000-0x00007FF9854E1000-memory.dmp

Filesize
10.8MB

Download
memory/340-143-0x00007FF984A20000-0x00007FF9854E1000-memory.dmp

Filesize
10.8MB

Download
memory/2204-134-0x0000000000000000-mapping.dmp

Download
memory/2948-135-0x0000000000000000-mapping.dmp

Download
memory/3736-132-0x00000188C99B0000-0x00000188C9A18000-memory.dmp

Filesize
416KB

Download
memory/3736-133-0x00007FF984A20000-0x00007FF9854E1000-memory.dmp

Filesize
10.8MB

Download
memory/3736-141-0x00007FF984A20000-0x00007FF9854E1000-memory.dmp

Filesize
10.8MB

Download
memory/4988-137-0x0000000000000000-mapping.dmp

Download
memory/5076-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads