dcrat | e265b6463579660b348a31ee258dbe9da699f5dbfd3649944ad4d2b61daf6cd1

General

Target

0788f92fd80bc11117bec239bb15755d.exe
Size

765KB
MD5

0788f92fd80bc11117bec239bb15755d
SHA1

10e4dd67943d8dfb22a223e0ce09597b5346144b
SHA256

e265b6463579660b348a31ee258dbe9da699f5dbfd3649944ad4d2b61daf6cd1
SHA512

3257b30d4527d0a0de2e7d89ce6e3afaebfa671b0392d4558a1b6fd364f64bb313d0a5472bbfaf4f269148f6b49ccd54ab2532ef5084c2548146ce7327087517
SSDEEP

6144:nNg3uaSnrqUkT4CTAsc4gOL2+KKVxqFHa6fY++CyeSoSmF8OnFz1nCsLyyBA9whp:NKupNkTz7ufC4VUobBqBLku0cnCW

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	3260	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	3260	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	3260	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	3260	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	3260	schtasks.exe	31

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	0788f92fd80bc11117bec239bb15755d.exe

Executes dropped EXE 1 IoCs

pid	Process
4716	explorer.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\upfc.exe\""	0788f92fd80bc11117bec239bb15755d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\msxml3r\\RuntimeBroker.exe\""	0788f92fd80bc11117bec239bb15755d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\Windows.Devices.Bluetooth\\RuntimeBroker.exe\""	0788f92fd80bc11117bec239bb15755d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Documents and Settings\\explorer.exe\""	0788f92fd80bc11117bec239bb15755d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Common Files\\Services\\Idle.exe\""	0788f92fd80bc11117bec239bb15755d.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\msxml3r\RuntimeBroker.exe	0788f92fd80bc11117bec239bb15755d.exe
File created	C:\Windows\System32\msxml3r\9e8d7a4ca61bd9	0788f92fd80bc11117bec239bb15755d.exe
File created	C:\Windows\System32\Windows.Devices.Bluetooth\RuntimeBroker.exe	0788f92fd80bc11117bec239bb15755d.exe
File created	C:\Windows\System32\Windows.Devices.Bluetooth\9e8d7a4ca61bd9	0788f92fd80bc11117bec239bb15755d.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\upfc.exe	0788f92fd80bc11117bec239bb15755d.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\upfc.exe	0788f92fd80bc11117bec239bb15755d.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ea1d8f6d871115	0788f92fd80bc11117bec239bb15755d.exe
File created	C:\Program Files\Common Files\Services\Idle.exe	0788f92fd80bc11117bec239bb15755d.exe
File created	C:\Program Files\Common Files\Services\6ccacd8608530f	0788f92fd80bc11117bec239bb15755d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1192	schtasks.exe
2016	schtasks.exe
368	schtasks.exe
3236	schtasks.exe
4992	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	0788f92fd80bc11117bec239bb15755d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
444	0788f92fd80bc11117bec239bb15755d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	444	0788f92fd80bc11117bec239bb15755d.exe
Token: SeDebugPrivilege	4716	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 1524	444	0788f92fd80bc11117bec239bb15755d.exe	88
PID 444 wrote to memory of 1524	444	0788f92fd80bc11117bec239bb15755d.exe	88
PID 1524 wrote to memory of 2368	1524	cmd.exe	90
PID 1524 wrote to memory of 2368	1524	cmd.exe	90
PID 1524 wrote to memory of 4716	1524	cmd.exe	95
PID 1524 wrote to memory of 4716	1524	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0788f92fd80bc11117bec239bb15755d.exe
"C:\Users\Admin\AppData\Local\Temp\0788f92fd80bc11117bec239bb15755d.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jHNJFihQxa.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2368
- - C:\Documents and Settings\explorer.exe
    "C:\Documents and Settings\explorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\msxml3r\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\Windows.Devices.Bluetooth\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\explorer.exe

Filesize
765KB

MD5
0788f92fd80bc11117bec239bb15755d

SHA1
10e4dd67943d8dfb22a223e0ce09597b5346144b

SHA256
e265b6463579660b348a31ee258dbe9da699f5dbfd3649944ad4d2b61daf6cd1

SHA512
3257b30d4527d0a0de2e7d89ce6e3afaebfa671b0392d4558a1b6fd364f64bb313d0a5472bbfaf4f269148f6b49ccd54ab2532ef5084c2548146ce7327087517

Download Submit
C:\Program Files\Common Files\Services\Idle.exe

Filesize
765KB

MD5
0788f92fd80bc11117bec239bb15755d

SHA1
10e4dd67943d8dfb22a223e0ce09597b5346144b

SHA256
e265b6463579660b348a31ee258dbe9da699f5dbfd3649944ad4d2b61daf6cd1

SHA512
3257b30d4527d0a0de2e7d89ce6e3afaebfa671b0392d4558a1b6fd364f64bb313d0a5472bbfaf4f269148f6b49ccd54ab2532ef5084c2548146ce7327087517

Download Submit
C:\Users\Admin\AppData\Local\Temp\jHNJFihQxa.bat

Filesize
202B

MD5
aa5185930f6cb9ae82a89b1b1280f529

SHA1
a8bbc84a25a71ed3b999229180164f234a6c8012

SHA256
6bcda150103732c38bc79abd21bab3a3d90e710e21b0060219b02c7e293f2353

SHA512
d1ac856723c12522e9d4d55dde1ad9990f925f126d8ae1e6fc84194ab96f4dd42be19ee65b0cc371d05fc94da403526e9291552a363474e7a35384361bcf9aa4

Download Submit
C:\Users\explorer.exe

Filesize
765KB

MD5
0788f92fd80bc11117bec239bb15755d

SHA1
10e4dd67943d8dfb22a223e0ce09597b5346144b

SHA256
e265b6463579660b348a31ee258dbe9da699f5dbfd3649944ad4d2b61daf6cd1

SHA512
3257b30d4527d0a0de2e7d89ce6e3afaebfa671b0392d4558a1b6fd364f64bb313d0a5472bbfaf4f269148f6b49ccd54ab2532ef5084c2548146ce7327087517

Download Submit
memory/444-133-0x0000000000740000-0x0000000000806000-memory.dmp

Filesize
792KB

Download
memory/444-134-0x000000001B4D0000-0x000000001B4E0000-memory.dmp

Filesize
64KB

Download
memory/4716-154-0x000000001B190000-0x000000001B1A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads