dcrat | 71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8

General

Target

71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe
Size

3.4MB
MD5

8136421aa9596cb02a6c30a99b376db5
SHA1

a4866f30925441944eb06e9540fd8740a7302b84
SHA256

71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8
SHA512

a6b2fcb864ecc6b10a2a08373d12d8f59f16e9ca22b1b014c2326807a1bb90ab84e1a0b9afd637a408c179f9025eee28f017e35bf6543fb59e06a12c9860bf8c
SSDEEP

24576:0BgrBN6i/BEuM75fCJaBSDVdMYHl6I4H8ykD3A:yIWqgBSDAYHl4cykD3A

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1976-54-0x0000000000400000-0x00000000004D8000-memory.dmp	dcrat
behavioral1/memory/1976-56-0x0000000000400000-0x00000000004D8000-memory.dmp	dcrat
behavioral1/memory/1976-58-0x0000000000400000-0x00000000004D8000-memory.dmp	dcrat

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ipinfo.io
6 ipinfo.io

flow	ioc
5	ipinfo.io
6	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

Processes:

71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe

description	pid	process	target process
PID 1744 set thread context of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

976 1744 WerFault.exe 71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe

pid	pid_target	process	target process
976	1744	WerFault.exe	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

InstallUtil.exe

pid	process
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe
1976	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 1976 InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1976	InstallUtil.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe

description	pid	process	target process
PID 1744 wrote to memory of 1756	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1756	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1756	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1756	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1756	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1756	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1756	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1756	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 1976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	InstallUtil.exe
PID 1744 wrote to memory of 976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	WerFault.exe
PID 1744 wrote to memory of 976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	WerFault.exe
PID 1744 wrote to memory of 976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	WerFault.exe
PID 1744 wrote to memory of 976	1744	71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe
"C:\Users\Admin\AppData\Local\Temp\71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:1756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 144
2⤵
- Program crash
PID:976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
82f55d598c3d3bb3716e0f341578788e

SHA1
2469e7763883e869611308acbcfc6c905dddf677

SHA256
ec20af12c36709988fc9eb915c9335c577089e04fd63c3156454e7c79bdd7063

SHA512
edc4e9223dc0426e84c94cfc96e74096b0f75ea96b0323a2e8f5e04dd0665f48d41451c91735cf0b6cd4683e994165455260d5e31d4c830f7a3a779cd5b5de5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63E4.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65BF.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/1976-62-0x0000000000940000-0x000000000094E000-memory.dmp

Filesize
56KB

Download
memory/1976-61-0x00000000008C0000-0x00000000008D6000-memory.dmp

Filesize
88KB

Download
memory/1976-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1976-63-0x0000000000CF0000-0x0000000000CFE000-memory.dmp

Filesize
56KB

Download
memory/1976-64-0x00000000008F0000-0x0000000000930000-memory.dmp

Filesize
256KB

Download
memory/1976-65-0x00000000008F0000-0x0000000000930000-memory.dmp

Filesize
256KB

Download
memory/1976-66-0x00000000008F0000-0x0000000000930000-memory.dmp

Filesize
256KB

Download
memory/1976-60-0x00000000008A0000-0x00000000008BC000-memory.dmp

Filesize
112KB

Download
memory/1976-59-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download
memory/1976-58-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1976-56-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads