dcrat | 5d3511735bed246367c3fa97c21ce7bdc9ade8ce5212d4a40504ddc9a9330122

General

Target

08002399.exe
Size

807KB
MD5

1daeb81d9c3201beb8ea848fd869fc80
SHA1

33aaf3d172952a169e97b4912506b08df3e01c75
SHA256

5d3511735bed246367c3fa97c21ce7bdc9ade8ce5212d4a40504ddc9a9330122
SHA512

1b998a59a2c4d746b270ba5fddd1c1000f457d627c2bef114ea6d116085004deffbfd83d0f50ad56bc1bc366b3647da2499357b704fc4a303e3bbc74f242c115
SSDEEP

24576:KUHKH42cH3Gz0BwDbu2fglQPvX+QZZUI1L3:KuKHGHWgIu+f+QD3

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

AppLaunch.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	AppLaunch.exe

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	1612	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	1612	schtasks.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1092-56-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat
behavioral1/memory/1092-62-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat
behavioral1/memory/1092-63-0x0000000000400000-0x00000000004A4000-memory.dmp	dcrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

08002399.exe

description pid process target process

PID 2028 set thread context of 1092 2028 08002399.exe AppLaunch.exe

description	pid	process	target process
PID 2028 set thread context of 1092	2028	08002399.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

AppLaunch.exe

pid	process
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe
1092	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 1092 AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1092	AppLaunch.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

08002399.exeAppLaunch.execmd.exew32tm.exe

description	pid	process	target process
PID 2028 wrote to memory of 1092	2028	08002399.exe	AppLaunch.exe
PID 2028 wrote to memory of 1092	2028	08002399.exe	AppLaunch.exe
PID 2028 wrote to memory of 1092	2028	08002399.exe	AppLaunch.exe
PID 2028 wrote to memory of 1092	2028	08002399.exe	AppLaunch.exe
PID 2028 wrote to memory of 1092	2028	08002399.exe	AppLaunch.exe
PID 2028 wrote to memory of 1092	2028	08002399.exe	AppLaunch.exe
PID 2028 wrote to memory of 1092	2028	08002399.exe	AppLaunch.exe
PID 2028 wrote to memory of 1092	2028	08002399.exe	AppLaunch.exe
PID 2028 wrote to memory of 1092	2028	08002399.exe	AppLaunch.exe
PID 1092 wrote to memory of 1072	1092	AppLaunch.exe	cmd.exe
PID 1092 wrote to memory of 1072	1092	AppLaunch.exe	cmd.exe
PID 1092 wrote to memory of 1072	1092	AppLaunch.exe	cmd.exe
PID 1092 wrote to memory of 1072	1092	AppLaunch.exe	cmd.exe
PID 1092 wrote to memory of 1072	1092	AppLaunch.exe	cmd.exe
PID 1092 wrote to memory of 1072	1092	AppLaunch.exe	cmd.exe
PID 1092 wrote to memory of 1072	1092	AppLaunch.exe	cmd.exe
PID 1072 wrote to memory of 856	1072	cmd.exe	w32tm.exe
PID 1072 wrote to memory of 856	1072	cmd.exe	w32tm.exe
PID 1072 wrote to memory of 856	1072	cmd.exe	w32tm.exe
PID 1072 wrote to memory of 856	1072	cmd.exe	w32tm.exe
PID 1072 wrote to memory of 856	1072	cmd.exe	w32tm.exe
PID 1072 wrote to memory of 856	1072	cmd.exe	w32tm.exe
PID 1072 wrote to memory of 856	1072	cmd.exe	w32tm.exe
PID 856 wrote to memory of 896	856	w32tm.exe	w32tm.exe
PID 856 wrote to memory of 896	856	w32tm.exe	w32tm.exe
PID 856 wrote to memory of 896	856	w32tm.exe	w32tm.exe
PID 856 wrote to memory of 896	856	w32tm.exe	w32tm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\08002399.exe
"C:\Users\Admin\AppData\Local\Temp\08002399.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
2⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
4⤵
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
5⤵
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "AppLaunch" /f
1⤵
- Process spawned unexpected child process
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "AppLaunchA" /f
1⤵
- Process spawned unexpected child process
PID:392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat
Filesize
305B

MD5
ffe36d9748fd1046ecab190c6bfe68cc

SHA1
12604e4e14fa0e62cb9745d451d93dc1c2306ac5

SHA256
daa8fafed958b515e5e9d502951c95e4a729fba87bc0086943aa1510c46bfd7a

SHA512
76196443db5be627b105b8e9c20d482c0bfb4b57e1bd57e75627ced2a63854069c50e615f9bf124e1b4ae55756c334b82fc884a4d4c808c69a4e93b5b6424850

Download Submit
C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat
Filesize
305B

MD5
ffe36d9748fd1046ecab190c6bfe68cc

SHA1
12604e4e14fa0e62cb9745d451d93dc1c2306ac5

SHA256
daa8fafed958b515e5e9d502951c95e4a729fba87bc0086943aa1510c46bfd7a

SHA512
76196443db5be627b105b8e9c20d482c0bfb4b57e1bd57e75627ced2a63854069c50e615f9bf124e1b4ae55756c334b82fc884a4d4c808c69a4e93b5b6424850

Download Submit
memory/1092-55-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1092-56-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1092-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1092-62-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1092-63-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1092-64-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/1092-65-0x00000000004C0000-0x00000000004D6000-memory.dmp

Filesize
88KB

Download
memory/1092-66-0x0000000000730000-0x0000000000770000-memory.dmp

Filesize
256KB

Download
memory/1092-84-0x0000000000730000-0x0000000000770000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads