dcrat | 946a6844d3ab11e9550bf3ecc40187aef2ff2e5b049af7fe9f75b28a9ca6acf0

General

Target
a1e507f0fb860258d1fb4673200763c3.exe
Size 1001KB
Sample230205-fa4f1sgc45
SHA256 946a6844d3ab11e9550bf3ecc40187aef2ff2e5b049af7fe9f75b28a9ca6acf0
MD5 a1e507f0fb860258d1fb4673200763c3
SHA1 aa7903af457e39469493c3078ea941da372e7734
SHA512 4cf52ce8a3eaaf6d1003750780ab5e6f415e7cfaf3d3b57f4b6c84ada12054bb653ee4518f893b8d858e634a678abd03196e698769121cb014eb56955e240179
SSDEEP 24576:Ga8qqs90Axyz/A4PI8v5wp5lvLg23R2Sj:G1s90AxilPI8v5elvL9gS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	1088	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	1088	schtasks.exe	27

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1684-54-0x0000000000290000-0x0000000000392000-memory.dmp	dcrat
behavioral1/files/0x00070000000136c6-59.dat	dcrat
behavioral1/files/0x00070000000136c6-61.dat	dcrat
behavioral1/memory/2020-62-0x00000000009E0000-0x0000000000AE2000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2020	WMIADAP.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\it-IT\6203df4a6bafc7	a1e507f0fb860258d1fb4673200763c3.exe
File opened for modification	C:\Program Files\Windows Portable Devices\csrss.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files\Windows Portable Devices\886983d96e3d3e	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\Idle.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\6ccacd8608530f	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files\DVD Maker\it-IT\lsass.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\explorer.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\7a0fd90576e088	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Program Files\Windows Portable Devices\csrss.exe	a1e507f0fb860258d1fb4673200763c3.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Web\Wallpaper\Characters\WMIADAP.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Windows\Web\Wallpaper\Characters\75a57c1bdf437c	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Windows\Registration\CRMLog\explorer.exe	a1e507f0fb860258d1fb4673200763c3.exe
File created	C:\Windows\Registration\CRMLog\7a0fd90576e088	a1e507f0fb860258d1fb4673200763c3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
572	schtasks.exe
672	schtasks.exe
776	schtasks.exe
1904	schtasks.exe
1144	schtasks.exe
1824	schtasks.exe
1360	schtasks.exe
524	schtasks.exe
1208	schtasks.exe
2028	schtasks.exe
2000	schtasks.exe
1296	schtasks.exe
1632	schtasks.exe
1816	schtasks.exe
1760	schtasks.exe
1456	schtasks.exe
1068	schtasks.exe
1740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1684	a1e507f0fb860258d1fb4673200763c3.exe
1684	a1e507f0fb860258d1fb4673200763c3.exe
1684	a1e507f0fb860258d1fb4673200763c3.exe
2020	WMIADAP.exe
2020	WMIADAP.exe
2020	WMIADAP.exe
2020	WMIADAP.exe
2020	WMIADAP.exe
2020	WMIADAP.exe
2020	WMIADAP.exe
2020	WMIADAP.exe
2020	WMIADAP.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	a1e507f0fb860258d1fb4673200763c3.exe
Token: SeDebugPrivilege	2020	WMIADAP.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 956	1684	a1e507f0fb860258d1fb4673200763c3.exe	46
PID 1684 wrote to memory of 956	1684	a1e507f0fb860258d1fb4673200763c3.exe	46
PID 1684 wrote to memory of 956	1684	a1e507f0fb860258d1fb4673200763c3.exe	46
PID 956 wrote to memory of 928	956	cmd.exe	48
PID 956 wrote to memory of 928	956	cmd.exe	48
PID 956 wrote to memory of 928	956	cmd.exe	48
PID 956 wrote to memory of 2020	956	cmd.exe	49
PID 956 wrote to memory of 2020	956	cmd.exe	49
PID 956 wrote to memory of 2020	956	cmd.exe	49

C:\Users\Admin\AppData\Local\Temp\a1e507f0fb860258d1fb4673200763c3.exe
"C:\Users\Admin\AppData\Local\Temp\a1e507f0fb860258d1fb4673200763c3.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mcoqnN0SPi.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:928
- - C:\Windows\Web\Wallpaper\Characters\WMIADAP.exe
    "C:\Windows\Web\Wallpaper\Characters\WMIADAP.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Windows\Web\Wallpaper\Characters\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\Characters\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Windows\Web\Wallpaper\Characters\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\Registration\CRMLog\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\DVD Maker\it-IT\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\it-IT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\DVD Maker\it-IT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mcoqnN0SPi.bat

Path C:\Users\Admin\AppData\Local\Temp\mcoqnN0SPi.bat
Size 212B
SHA256 4f8da3365f720bbad9a17589a15516c9e7df20181c69c799702a1338fe52e66b
MD5 974591eb449cec3d41725770461e62d0
SHA1 1e44a7ee8721798b6835c627684d7049e410aa7d
SHA512 560b86bc2386f9b4c192739736623933b531676a170a28fa0b0d8d8750808e49db1ef47fbf4968ec1bc727e63f933aa3a768e77f37df5c6c041975ef590e26a4
MD5 SHA1 SHA512

Submit Download

WMIADAP.exe

Path C:\Windows\Web\Wallpaper\Characters\WMIADAP.exe
Size 1001KB
SHA256 946a6844d3ab11e9550bf3ecc40187aef2ff2e5b049af7fe9f75b28a9ca6acf0
MD5 a1e507f0fb860258d1fb4673200763c3
SHA1 aa7903af457e39469493c3078ea941da372e7734
SHA512 4cf52ce8a3eaaf6d1003750780ab5e6f415e7cfaf3d3b57f4b6c84ada12054bb653ee4518f893b8d858e634a678abd03196e698769121cb014eb56955e240179
SSDEEP 24576:Ga8qqs90Axyz/A4PI8v5wp5lvLg23R2Sj:G1s90AxilPI8v5elvL9gS
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMIADAP.exe

Path C:\Windows\Web\Wallpaper\Characters\WMIADAP.exe
Size 1001KB
SHA256 946a6844d3ab11e9550bf3ecc40187aef2ff2e5b049af7fe9f75b28a9ca6acf0
MD5 a1e507f0fb860258d1fb4673200763c3
SHA1 aa7903af457e39469493c3078ea941da372e7734
SHA512 4cf52ce8a3eaaf6d1003750780ab5e6f415e7cfaf3d3b57f4b6c84ada12054bb653ee4518f893b8d858e634a678abd03196e698769121cb014eb56955e240179
SSDEEP 24576:Ga8qqs90Axyz/A4PI8v5wp5lvLg23R2Sj:G1s90AxilPI8v5elvL9gS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1684-54-0x0000000000290000-0x0000000000392000-memory.dmp

Download

memory/1684-55-0x0000000000260000-0x000000000027C000-memory.dmp

Download

memory/2020-62-0x00000000009E0000-0x0000000000AE2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads