dcrat | 71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8

General

Target

71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe
Size

3.4MB
MD5

8136421aa9596cb02a6c30a99b376db5
SHA1

a4866f30925441944eb06e9540fd8740a7302b84
SHA256

71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8
SHA512

a6b2fcb864ecc6b10a2a08373d12d8f59f16e9ca22b1b014c2326807a1bb90ab84e1a0b9afd637a408c179f9025eee28f017e35bf6543fb59e06a12c9860bf8c
SSDEEP

24576:0BgrBN6i/BEuM75fCJaBSDVdMYHl6I4H8ykD3A:yIWqgBSDAYHl4cykD3A

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/780-54-0x0000000000400000-0x00000000004D8000-memory.dmp	dcrat
behavioral1/memory/780-56-0x0000000000400000-0x00000000004D8000-memory.dmp	dcrat
behavioral1/memory/780-58-0x0000000000400000-0x00000000004D8000-memory.dmp	dcrat

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ipinfo.io
6 ipinfo.io

flow	ioc
5	ipinfo.io
6	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

Processes:

71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe

description	pid	process	target process
PID 924 set thread context of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

652 924 WerFault.exe 71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe

pid	pid_target	process	target process
652	924	WerFault.exe	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

InstallUtil.exe

pid	process
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe
780	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 780 InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	780	InstallUtil.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe

description	pid	process	target process
PID 924 wrote to memory of 1212	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1212	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1212	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1212	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1212	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1212	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1212	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1212	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1976	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1976	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1976	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1976	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1976	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1976	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1976	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 1976	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 784	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 784	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 784	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 784	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 784	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 784	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 784	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 784	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 780	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 924 wrote to memory of 652	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	WerFault.exe
PID 924 wrote to memory of 652	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	WerFault.exe
PID 924 wrote to memory of 652	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	WerFault.exe
PID 924 wrote to memory of 652	924	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe
"C:\Users\Admin\AppData\Local\Temp\71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:1212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:1976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 172
2⤵
- Program crash
PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
29f88906586966d7246210b9bb069bbb

SHA1
c26c0e10831af7f9d9513f7dbf1d05e105f751ba

SHA256
589ef994a6ec4e5bb690b767f6af6fe34d1d95f8d76d8a57b7229d613158661f

SHA512
75ccbe20eee8b900635341e857bb2e31e816e7624a434bc7a69163d354eab9bd4a9de21def124ae70e57a50f07b6c3ffc72965eebaba9a58380057d4eb06f637

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7504.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar76A0.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/780-60-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/780-61-0x00000000006D0000-0x00000000006EC000-memory.dmp

Filesize
112KB

Download
memory/780-62-0x0000000000730000-0x0000000000746000-memory.dmp

Filesize
88KB

Download
memory/780-63-0x0000000001F30000-0x0000000001F3E000-memory.dmp

Filesize
56KB

Download
memory/780-64-0x0000000001F80000-0x0000000001F8E000-memory.dmp

Filesize
56KB

Download
memory/780-65-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

Filesize
256KB

Download
memory/780-66-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

Filesize
256KB

Download
memory/780-67-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

Filesize
256KB

Download
memory/780-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/780-59-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

Filesize
256KB

Download
memory/780-58-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/780-56-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads