dcrat | bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495

Analysis

max time kernel
178s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10/02/2023, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe
Size

1.3MB
MD5

ef87f963668f52d60ccc2e9742f40d27
SHA1

72d22dd53d2b81a28830c882060e61d66d4c9913
SHA256

bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495
SHA512

b7076589a9540613fd97f30eb431e3d8bdf439ab43c2262596ce2684cb74ce9c93ff35f9577fbe75267b80c82d690039a8c1fc244adb7d62285befa0e3a44ef2
SSDEEP

24576:VwcxYIu8NZSs53CZDXPIPljai7zFlj6zxyWxZy2QQVqTrx0G:VwcSIu7I9jDzFQhxnw0G

Score

10^/10

dcrat pandastealer infostealer rat stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Panda Stealer payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000022e3d-136.dat	family_pandastealer
behavioral2/files/0x0007000000022e3d-135.dat	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	4720	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	176	4720	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	4720	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	4720	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	4720	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	4720	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4720	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	4720	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	4720	schtasks.exe	85

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0008000000022e34-133.dat	dcrat
behavioral2/files/0x0008000000022e34-137.dat	dcrat
behavioral2/files/0x0007000000022e40-144.dat	dcrat
behavioral2/files/0x0007000000022e40-143.dat	dcrat
behavioral2/memory/460-145-0x0000000000070000-0x0000000000146000-memory.dmp	dcrat
behavioral2/files/0x0007000000022e42-153.dat	dcrat
behavioral2/files/0x0007000000022e42-154.dat	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	SessionRuntime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe

Executes dropped EXE 4 IoCs

pid	Process
2032	DCRatBuild.exe
840	prikol for ragemp.exe
460	SessionRuntime.exe
1800	sppsvc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\0a1fd5f707cd16	SessionRuntime.exe
File created	C:\Program Files\Windows Media Player\de-DE\SppExtComObj.exe	SessionRuntime.exe
File created	C:\Program Files\Windows Media Player\de-DE\e1ef82546f0b02	SessionRuntime.exe
File created	C:\Program Files\Windows Mail\sppsvc.exe	SessionRuntime.exe
File opened for modification	C:\Program Files\Windows Mail\sppsvc.exe	SessionRuntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
760	schtasks.exe
4480	schtasks.exe
4156	schtasks.exe
212	schtasks.exe
3328	schtasks.exe
4804	schtasks.exe
400	schtasks.exe
176	schtasks.exe
1892	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	SessionRuntime.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
460	SessionRuntime.exe
1800	sppsvc.exe
1800	sppsvc.exe
1800	sppsvc.exe
1800	sppsvc.exe
1800	sppsvc.exe
1800	sppsvc.exe
1800	sppsvc.exe
1800	sppsvc.exe
1800	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	460	SessionRuntime.exe
Token: SeDebugPrivilege	1800	sppsvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2032	4348	bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe	79
PID 4348 wrote to memory of 2032	4348	bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe	79
PID 4348 wrote to memory of 2032	4348	bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe	79
PID 4348 wrote to memory of 840	4348	bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe	80
PID 4348 wrote to memory of 840	4348	bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe	80
PID 4348 wrote to memory of 840	4348	bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe	80
PID 2032 wrote to memory of 1384	2032	DCRatBuild.exe	81
PID 2032 wrote to memory of 1384	2032	DCRatBuild.exe	81
PID 2032 wrote to memory of 1384	2032	DCRatBuild.exe	81
PID 1384 wrote to memory of 1612	1384	WScript.exe	82
PID 1384 wrote to memory of 1612	1384	WScript.exe	82
PID 1384 wrote to memory of 1612	1384	WScript.exe	82
PID 1612 wrote to memory of 460	1612	cmd.exe	84
PID 1612 wrote to memory of 460	1612	cmd.exe	84
PID 460 wrote to memory of 4060	460	SessionRuntime.exe	96
PID 460 wrote to memory of 4060	460	SessionRuntime.exe	96
PID 4060 wrote to memory of 1668	4060	cmd.exe	98
PID 4060 wrote to memory of 1668	4060	cmd.exe	98
PID 4060 wrote to memory of 1800	4060	cmd.exe	99
PID 4060 wrote to memory of 1800	4060	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe
"C:\Users\Admin\AppData\Local\Temp\bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Bridgehyperintosvc\hhW91xccJcHbriwNxwh8J2VR4DfT.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Bridgehyperintosvc\qmwizXZyAG.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Bridgehyperintosvc\SessionRuntime.exe
        
        "C:\Bridgehyperintosvc\SessionRuntime.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:460
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wfEj2T8k6F.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1668
        
        C:\Program Files\Windows Mail\sppsvc.exe
        
        "C:\Program Files\Windows Mail\sppsvc.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
- C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exe
  "C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exe"
  2⤵
  - Executes dropped EXE
  PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\de-DE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\de-DE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\de-DE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\odt\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Bridgehyperintosvc\SessionRuntime.exe

Filesize
828KB

MD5
ae23ccbd31f96a4051015724d155f40e

SHA1
799439e532b69c36f2e1fb5346ae7f93510c9594

SHA256
c68a49ebcf23549fd40879c7e7d95737effd1c3d704689dbe1bba4959dcbbd69

SHA512
61f683a97b8bc1550af40253e2c2e42d8edf4a5c06afb3f5dcc9216ab10c16550f9647ac6dbc85c1f5b3b7b8ab860090ccd6b92b8f41905264b079baf3ae16f8

Download Submit
C:\Bridgehyperintosvc\SessionRuntime.exe

Filesize
828KB

MD5
ae23ccbd31f96a4051015724d155f40e

SHA1
799439e532b69c36f2e1fb5346ae7f93510c9594

SHA256
c68a49ebcf23549fd40879c7e7d95737effd1c3d704689dbe1bba4959dcbbd69

SHA512
61f683a97b8bc1550af40253e2c2e42d8edf4a5c06afb3f5dcc9216ab10c16550f9647ac6dbc85c1f5b3b7b8ab860090ccd6b92b8f41905264b079baf3ae16f8

Download Submit
C:\Bridgehyperintosvc\hhW91xccJcHbriwNxwh8J2VR4DfT.vbe

Filesize
205B

MD5
69a1055c45c69385f54f6c9f2f90d3b5

SHA1
3d5e79e4c9ce42ffe83b78ec8dc56a19d281c4b5

SHA256
2c20f9301f7693eb0b2c66c6847e4f225526d912cd1a3991e0fbeaa2297e4cf2

SHA512
c5cc288244b50182e61102e736888980f0de1bbcc596dd03f6d928f41d91dbcc38a799c813ea762f541e151ac0e62fb5b5d0d69bcf367c67fd55ede6d0c4411d

Download Submit
C:\Bridgehyperintosvc\qmwizXZyAG.bat

Filesize
42B

MD5
11638d0e4750c66f861582ba291fab83

SHA1
2b355fd2188f0474799060d308123d4d9fdbea53

SHA256
7663a9d61b00888cb9aec3aefd0829f83a1358f53d4141525b13f2c4c6beb4a8

SHA512
77cd768c8c4718221961c1d07ee7c4296432f135c47a18e244d4d5d6b8067feade2e46a8db93a61040212d87df8a888e23f9ed1065ad3c0314ad3ab2ef43139e

Download Submit
C:\Program Files\Windows Mail\sppsvc.exe

Filesize
828KB

MD5
ae23ccbd31f96a4051015724d155f40e

SHA1
799439e532b69c36f2e1fb5346ae7f93510c9594

SHA256
c68a49ebcf23549fd40879c7e7d95737effd1c3d704689dbe1bba4959dcbbd69

SHA512
61f683a97b8bc1550af40253e2c2e42d8edf4a5c06afb3f5dcc9216ab10c16550f9647ac6dbc85c1f5b3b7b8ab860090ccd6b92b8f41905264b079baf3ae16f8

Download Submit
C:\Program Files\Windows Mail\sppsvc.exe

Filesize
828KB

MD5
ae23ccbd31f96a4051015724d155f40e

SHA1
799439e532b69c36f2e1fb5346ae7f93510c9594

SHA256
c68a49ebcf23549fd40879c7e7d95737effd1c3d704689dbe1bba4959dcbbd69

SHA512
61f683a97b8bc1550af40253e2c2e42d8edf4a5c06afb3f5dcc9216ab10c16550f9647ac6dbc85c1f5b3b7b8ab860090ccd6b92b8f41905264b079baf3ae16f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
1.1MB

MD5
a2c5f46a7d17c9844358eb6500a345cb

SHA1
bb3e57b426e1bf102d865e43eb2afb3950858d1e

SHA256
19490af8d7da0244954c09bb56e6cfc2543b22627fce1eb4662ef450d94e957d

SHA512
8317eb7d0e3e25f614c7c739ae78b30a04b7ea95bcb62e209ab5b4e8e56515a8e344da69f0653e2b10fcd0d52479410a21dbe93231fdbdc2858364ffc3f7e2fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
1.1MB

MD5
a2c5f46a7d17c9844358eb6500a345cb

SHA1
bb3e57b426e1bf102d865e43eb2afb3950858d1e

SHA256
19490af8d7da0244954c09bb56e6cfc2543b22627fce1eb4662ef450d94e957d

SHA512
8317eb7d0e3e25f614c7c739ae78b30a04b7ea95bcb62e209ab5b4e8e56515a8e344da69f0653e2b10fcd0d52479410a21dbe93231fdbdc2858364ffc3f7e2fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exe

Filesize
632KB

MD5
6040707130367eb1bc81b9676f15fc54

SHA1
9e646196cd9b221f0b5177c48ee598fd996a1e87

SHA256
38c9837521f53f72d53ce83e6b3be97b57c20eea9a52b44672842683fa6b3409

SHA512
a736dc596821761ee8e018fa6f4f2709fa70aa745900b6882a2588e4cda9be132fd263f7284ed5a565822c767f12d4d9bc8696516b00434158c0181ce86b22ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exe

Filesize
632KB

MD5
6040707130367eb1bc81b9676f15fc54

SHA1
9e646196cd9b221f0b5177c48ee598fd996a1e87

SHA256
38c9837521f53f72d53ce83e6b3be97b57c20eea9a52b44672842683fa6b3409

SHA512
a736dc596821761ee8e018fa6f4f2709fa70aa745900b6882a2588e4cda9be132fd263f7284ed5a565822c767f12d4d9bc8696516b00434158c0181ce86b22ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\wfEj2T8k6F.bat

Filesize
205B

MD5
0538ee666d9a6d45194e1caf90a5b125

SHA1
ef1cd8d594bdd37f1a7644f69a325509e97d0c08

SHA256
1c6a524c4224b8c8eb118530af53c5f60c606b607ed22191f5d8a3b74afdfbfb

SHA512
072e8bc113d830e8a90fc7530c18bab094c3c428ff2489c58d27a7525a3ffb6997e2ae4e26e611ba017964e02fda074fa5057af0c45c6cf545ed159065ccb3a5

Download Submit
memory/460-149-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmp

Filesize
10.8MB

Download
memory/460-145-0x0000000000070000-0x0000000000146000-memory.dmp

Filesize
856KB

Download
memory/460-146-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmp

Filesize
10.8MB

Download
memory/460-147-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmp

Filesize
10.8MB

Download
memory/1800-155-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmp

Filesize
10.8MB

Download
memory/1800-156-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmp

Filesize
10.8MB

Download