dcrat | 892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66

General

Target

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Size

382KB
MD5

e341dce8ea14c62cdb2c2a0082c06e6f
SHA1

40e13801d6e48317eac0019a5d69b5385afe4cd7
SHA256

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66
SHA512

d9722cea91e6d4268b4b799c33022978eef8a70f5fb8056b13c60ca2fbe5772423141f94e7ef58095fc49eefb6e0a217a11903e7d23d0c9e8838502225d07b69
SSDEEP

6144:Nhg8RILt0ndjMKoeHUSI8zNqjFNa4Xn2J+TiqqDL:NZndjZVVwk5J0Xqn

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1228-54-0x0000000000120000-0x0000000000188000-memory.dmp	dcrat
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe	dcrat
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe	dcrat
behavioral1/memory/1696-61-0x0000000000940000-0x00000000009A8000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

explorer.exe

pid process

1696 explorer.exe

pid	process
1696	explorer.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\smss.exe\""	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\\csrss.exe\""	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\explorer.exe\""	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

Drops file in Program Files directory 2 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

description	ioc	process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

Drops file in Windows directory 2 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

description	ioc	process
File created	C:\Windows\CSC\v2.0.6\WmiPrvSE.exe	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
File created	C:\Windows\CSC\v2.0.6\dwm.exe	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

560 schtasks.exe
1916 schtasks.exe
1212 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exeexplorer.exe

pid process

1228 892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
1696 explorer.exe

pid	process
560	schtasks.exe
1916	schtasks.exe
1212	schtasks.exe

pid	process
1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
1696	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Token: SeDebugPrivilege	1696	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

description	pid	process	target process
PID 1228 wrote to memory of 560	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 1228 wrote to memory of 560	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 1228 wrote to memory of 560	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 1228 wrote to memory of 1916	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 1228 wrote to memory of 1916	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 1228 wrote to memory of 1916	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 1228 wrote to memory of 1212	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 1228 wrote to memory of 1212	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 1228 wrote to memory of 1212	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 1228 wrote to memory of 1696	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	explorer.exe
PID 1228 wrote to memory of 1696	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	explorer.exe
PID 1228 wrote to memory of 1696	1228	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
"C:\Users\Admin\AppData\Local\Temp\892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\smss.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\csrss.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1212

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe
Filesize
382KB

MD5
e341dce8ea14c62cdb2c2a0082c06e6f

SHA1
40e13801d6e48317eac0019a5d69b5385afe4cd7

SHA256
892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66

SHA512
d9722cea91e6d4268b4b799c33022978eef8a70f5fb8056b13c60ca2fbe5772423141f94e7ef58095fc49eefb6e0a217a11903e7d23d0c9e8838502225d07b69

Download Submit
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe
Filesize
382KB

MD5
e341dce8ea14c62cdb2c2a0082c06e6f

SHA1
40e13801d6e48317eac0019a5d69b5385afe4cd7

SHA256
892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66

SHA512
d9722cea91e6d4268b4b799c33022978eef8a70f5fb8056b13c60ca2fbe5772423141f94e7ef58095fc49eefb6e0a217a11903e7d23d0c9e8838502225d07b69

Download Submit
memory/560-55-0x0000000000000000-mapping.dmp

Download
memory/1212-57-0x0000000000000000-mapping.dmp

Download
memory/1228-54-0x0000000000120000-0x0000000000188000-memory.dmp

Filesize
416KB

Download
memory/1696-58-0x0000000000000000-mapping.dmp

Download
memory/1696-61-0x0000000000940000-0x00000000009A8000-memory.dmp

Filesize
416KB

Download
memory/1916-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads