dcrat | 892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66

General

Target

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Size

382KB
MD5

e341dce8ea14c62cdb2c2a0082c06e6f
SHA1

40e13801d6e48317eac0019a5d69b5385afe4cd7
SHA256

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66
SHA512

d9722cea91e6d4268b4b799c33022978eef8a70f5fb8056b13c60ca2fbe5772423141f94e7ef58095fc49eefb6e0a217a11903e7d23d0c9e8838502225d07b69
SSDEEP

6144:Nhg8RILt0ndjMKoeHUSI8zNqjFNa4Xn2J+TiqqDL:NZndjZVVwk5J0Xqn

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/4996-132-0x0000029D58A00000-0x0000029D58A68000-memory.dmp	dcrat
C:\Program Files\Common Files\DESIGNER\conhost.exe	dcrat
C:\Program Files\Common Files\DESIGNER\conhost.exe	dcrat

Executes dropped EXE 1 IoCs

Processes:

conhost.exe

pid process

3992 conhost.exe

pid	process
3992	conhost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Common Files\\DESIGNER\\WaaSMedicAgent.exe\""	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Media Player\\RuntimeBroker.exe\""	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Provisioning\\Packages\\dllhost.exe\""	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default\\Links\\System.exe\""	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Common Files\\DESIGNER\\conhost.exe\""	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

Drops file in Program Files directory 7 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
File created	C:\Program Files (x86)\Windows Media Player\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
File created	C:\Program Files\Common Files\DESIGNER\conhost.exe	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
File created	C:\Program Files\Common Files\DESIGNER\088424020bedd6b28ac7fd22ee35dcd7322895ce	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
File created	C:\Program Files\Common Files\DESIGNER\WaaSMedicAgent.exe	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\WaaSMedicAgent.exe	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
File created	C:\Program Files\Common Files\DESIGNER\c82b8037eab33d1fe33ed5c436875fcafdbefbee	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

Drops file in Windows directory 2 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

description	ioc	process
File created	C:\Windows\Provisioning\Packages\dllhost.exe	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
File created	C:\Windows\Provisioning\Packages\5940a34987c99120d96dace90a3f93f329dcad63	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4140 schtasks.exe
1148 schtasks.exe
2888 schtasks.exe
3196 schtasks.exe
1812 schtasks.exe
1268 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.execonhost.exe

pid process

4996 892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
3992 conhost.exe

pid	process
4140	schtasks.exe
1148	schtasks.exe
2888	schtasks.exe
3196	schtasks.exe
1812	schtasks.exe
1268	schtasks.exe

pid	process
4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
3992	conhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.execonhost.exe

description	pid	process
Token: SeDebugPrivilege	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
Token: SeDebugPrivilege	3992	conhost.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe

description	pid	process	target process
PID 4996 wrote to memory of 1148	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 1148	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 2888	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 2888	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 3196	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 3196	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 1812	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 1812	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 1268	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 1268	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 4140	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 4140	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	schtasks.exe
PID 4996 wrote to memory of 3992	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	conhost.exe
PID 4996 wrote to memory of 3992	4996	892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe
"C:\Users\Admin\AppData\Local\Temp\892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\WaaSMedicAgent.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1148

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2888

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:3196

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Provisioning\Packages\dllhost.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1812

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Links\System.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1268

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\conhost.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:4140

C:\Program Files\Common Files\DESIGNER\conhost.exe
"C:\Program Files\Common Files\DESIGNER\conhost.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\DESIGNER\conhost.exe
Filesize
382KB

MD5
e341dce8ea14c62cdb2c2a0082c06e6f

SHA1
40e13801d6e48317eac0019a5d69b5385afe4cd7

SHA256
892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66

SHA512
d9722cea91e6d4268b4b799c33022978eef8a70f5fb8056b13c60ca2fbe5772423141f94e7ef58095fc49eefb6e0a217a11903e7d23d0c9e8838502225d07b69

Download Submit
C:\Program Files\Common Files\DESIGNER\conhost.exe
Filesize
382KB

MD5
e341dce8ea14c62cdb2c2a0082c06e6f

SHA1
40e13801d6e48317eac0019a5d69b5385afe4cd7

SHA256
892555689233c21dfdfc0fb10a8241b92d36dd7b2831b28331b2efb6b219fd66

SHA512
d9722cea91e6d4268b4b799c33022978eef8a70f5fb8056b13c60ca2fbe5772423141f94e7ef58095fc49eefb6e0a217a11903e7d23d0c9e8838502225d07b69

Download Submit
memory/1148-134-0x0000000000000000-mapping.dmp

Download
memory/1268-138-0x0000000000000000-mapping.dmp

Download
memory/1812-137-0x0000000000000000-mapping.dmp

Download
memory/2888-135-0x0000000000000000-mapping.dmp

Download
memory/3196-136-0x0000000000000000-mapping.dmp

Download
memory/3992-140-0x0000000000000000-mapping.dmp

Download
memory/3992-144-0x00007FF948800000-0x00007FF9492C1000-memory.dmp

Filesize
10.8MB

Download
memory/3992-145-0x00007FF948800000-0x00007FF9492C1000-memory.dmp

Filesize
10.8MB

Download
memory/4140-139-0x0000000000000000-mapping.dmp

Download
memory/4996-132-0x0000029D58A00000-0x0000029D58A68000-memory.dmp

Filesize
416KB

Download
memory/4996-133-0x00007FF948800000-0x00007FF9492C1000-memory.dmp

Filesize
10.8MB

Download
memory/4996-143-0x00007FF948800000-0x00007FF9492C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads