dcrat | 2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517

Resubmissions

04/12/2023, 06:08

231204-gv1fjahd3810

02/12/2023, 09:25

231202-ldq8rabd3510

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2023, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517.exe
Size 1.1MB
Sample231202-ldq8rabd35
SHA256 2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517
MD5 71ea6268f9069ce113824b4ad34384ff
SHA1 c6faa871c7434ff60583de306b6947ef7feadc06
SHA512 e4fe605eb621eb8ae9710d6d1d7cf802e8c66c384c731cdcee50e8c19dbb22a0d23338d368bb89b908f50831cc12d5cc9e541b8e2887b2f505863afa2bce6241
SSDEEP 24576:U2G/nvxW3Ww0tACSUGFzLmBqSQ25wE2yrnj4FA5:UbA30ACSxiBqSQYyw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	5044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	5044	schtasks.exe	93

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023210-10.dat	dcrat
behavioral2/files/0x0007000000023210-11.dat	dcrat
behavioral2/memory/1972-12-0x0000000000A50000-0x0000000000B26000-memory.dmp	dcrat
behavioral2/files/0x0006000000023217-17.dat	dcrat
behavioral2/files/0x000600000002321b-35.dat	dcrat
behavioral2/files/0x000600000002321b-37.dat	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation	2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517.exe
Key value queried	\REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation	HyperBlock.exe

Executes dropped EXE 2 IoCs

pid	Process
1972	HyperBlock.exe
1852	StartMenuExperienceHost.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\fonts\HyperBlock.exe	HyperBlock.exe
File created	C:\Program Files\Mozilla Firefox\fonts\fab4570e5cce6c	HyperBlock.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\wininit.exe	HyperBlock.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\56085415360792	HyperBlock.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\InputMethod\SHARED\StartMenuExperienceHost.exe	HyperBlock.exe
File created	C:\Windows\InputMethod\SHARED\55b276f4edf653	HyperBlock.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1096	schtasks.exe
4284	schtasks.exe
680	schtasks.exe
3232	schtasks.exe
404	schtasks.exe
4792	schtasks.exe
4408	schtasks.exe
3604	schtasks.exe
1152	schtasks.exe
228	schtasks.exe
3120	schtasks.exe
2240	schtasks.exe
2080	schtasks.exe
5072	schtasks.exe
3616	schtasks.exe
3944	schtasks.exe
5048	schtasks.exe
4616	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000_Classes\Local Settings	2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1972	HyperBlock.exe
1972	HyperBlock.exe
1972	HyperBlock.exe
1852	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	HyperBlock.exe
Token: SeDebugPrivilege	1852	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 344	4820	2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517.exe	89
PID 4820 wrote to memory of 344	4820	2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517.exe	89
PID 4820 wrote to memory of 344	4820	2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517.exe	89
PID 344 wrote to memory of 696	344	WScript.exe	90
PID 344 wrote to memory of 696	344	WScript.exe	90
PID 344 wrote to memory of 696	344	WScript.exe	90
PID 696 wrote to memory of 1972	696	cmd.exe	92
PID 696 wrote to memory of 1972	696	cmd.exe	92
PID 1972 wrote to memory of 1852	1972	HyperBlock.exe	112
PID 1972 wrote to memory of 1852	1972	HyperBlock.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517.exe
"C:\Users\Admin\AppData\Local\Temp\2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\serverdriver\JdCENAvyBRh39KXhydh9AHWSWANjW.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\serverdriver\NGaeJO4sx701CVjh4zDKZs7XGdp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\serverdriver\HyperBlock.exe
      "C:\serverdriver\HyperBlock.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1972
    - - C:\Windows\InputMethod\SHARED\StartMenuExperienceHost.exe
        
        "C:\Windows\InputMethod\SHARED\StartMenuExperienceHost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\serverdriver\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\serverdriver\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\serverdriver\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\InputMethod\SHARED\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\InputMethod\SHARED\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperBlockH" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\fonts\HyperBlock.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperBlock" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\HyperBlock.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperBlockH" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\fonts\HyperBlock.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wininit.exe

Path C:\Program Files\WindowsPowerShell\Configuration\Registration\wininit.exe
Size 827KB
SHA256 e4de760d0e8342ec412f4fbb5a55131a9b5e5850a3b234bf230923e85a9aae62
MD5 a2d8227e18f5c1026567bb61c073a8f3
SHA1 724feb869635425712809d66412638660b1decd4
SHA512 cad0bc0e26da83ca46f58064cf0f8653cb7ac1caa197fce9d074ab6cef454f3a098ce669ddcfa47e50c4d13473c7339bd05d62321bb3bab66f526b3aafa7a629
SSDEEP 12288:/vXLCbYrUGFJTtLmBqdFaQAHIEwEJi1yH7uiBRrdnZ17zDgO4A:rCSUGFzLmBqSQ25wE2yrnj4FA
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartMenuExperienceHost.exe

Path C:\Windows\InputMethod\SHARED\StartMenuExperienceHost.exe
Size 827KB
SHA256 e4de760d0e8342ec412f4fbb5a55131a9b5e5850a3b234bf230923e85a9aae62
MD5 a2d8227e18f5c1026567bb61c073a8f3
SHA1 724feb869635425712809d66412638660b1decd4
SHA512 cad0bc0e26da83ca46f58064cf0f8653cb7ac1caa197fce9d074ab6cef454f3a098ce669ddcfa47e50c4d13473c7339bd05d62321bb3bab66f526b3aafa7a629
SSDEEP 12288:/vXLCbYrUGFJTtLmBqdFaQAHIEwEJi1yH7uiBRrdnZ17zDgO4A:rCSUGFzLmBqSQ25wE2yrnj4FA
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartMenuExperienceHost.exe

Path C:\Windows\InputMethod\SHARED\StartMenuExperienceHost.exe
Size 827KB
SHA256 e4de760d0e8342ec412f4fbb5a55131a9b5e5850a3b234bf230923e85a9aae62
MD5 a2d8227e18f5c1026567bb61c073a8f3
SHA1 724feb869635425712809d66412638660b1decd4
SHA512 cad0bc0e26da83ca46f58064cf0f8653cb7ac1caa197fce9d074ab6cef454f3a098ce669ddcfa47e50c4d13473c7339bd05d62321bb3bab66f526b3aafa7a629
SSDEEP 12288:/vXLCbYrUGFJTtLmBqdFaQAHIEwEJi1yH7uiBRrdnZ17zDgO4A:rCSUGFzLmBqSQ25wE2yrnj4FA
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyperBlock.exe

Path C:\serverdriver\HyperBlock.exe
Size 827KB
SHA256 e4de760d0e8342ec412f4fbb5a55131a9b5e5850a3b234bf230923e85a9aae62
MD5 a2d8227e18f5c1026567bb61c073a8f3
SHA1 724feb869635425712809d66412638660b1decd4
SHA512 cad0bc0e26da83ca46f58064cf0f8653cb7ac1caa197fce9d074ab6cef454f3a098ce669ddcfa47e50c4d13473c7339bd05d62321bb3bab66f526b3aafa7a629
SSDEEP 12288:/vXLCbYrUGFJTtLmBqdFaQAHIEwEJi1yH7uiBRrdnZ17zDgO4A:rCSUGFzLmBqSQ25wE2yrnj4FA
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyperBlock.exe

Path C:\serverdriver\HyperBlock.exe
Size 827KB
SHA256 e4de760d0e8342ec412f4fbb5a55131a9b5e5850a3b234bf230923e85a9aae62
MD5 a2d8227e18f5c1026567bb61c073a8f3
SHA1 724feb869635425712809d66412638660b1decd4
SHA512 cad0bc0e26da83ca46f58064cf0f8653cb7ac1caa197fce9d074ab6cef454f3a098ce669ddcfa47e50c4d13473c7339bd05d62321bb3bab66f526b3aafa7a629
SSDEEP 12288:/vXLCbYrUGFJTtLmBqdFaQAHIEwEJi1yH7uiBRrdnZ17zDgO4A:rCSUGFzLmBqSQ25wE2yrnj4FA
MD5 SHA1 SHA512 SSDEEP

Submit Download

JdCENAvyBRh39KXhydh9AHWSWANjW.vbe

Path C:\serverdriver\JdCENAvyBRh39KXhydh9AHWSWANjW.vbe
Size 216B
SHA256 21b5bdc706a3a2e5faaff3b188c4a9106fceda2aa6c666d20a3c9abeffd839f9
MD5 7b8d8f5a079b24b4da29e2ad969c5657
SHA1 d71982e60923cff5e04ee08b3ee00252499aed39
SHA512 8f6fa72e36ee9a5ab6b2df7c40ea597a505efdc0826e6e646093cfa399941ef40ce59b1509cf1f873966f9294cc7829064659a2774f12bf6e79211f1c1e60f41
MD5 SHA1 SHA512

Submit Download

NGaeJO4sx701CVjh4zDKZs7XGdp.bat

Path C:\serverdriver\NGaeJO4sx701CVjh4zDKZs7XGdp.bat
Size 32B
SHA256 3a86ef493e05ce395fa0bb95355efbd3522bc3d5563f9df4df79d3604dd110e6
MD5 f44d0cefc02232a8ad8d949318c49903
SHA1 5fb57ed63242cc38b4250c49664ee8e6a146e92e
SHA512 bb3bc941c88043c400be9d9db45edde13c7666f2fe025735182f6c55c8ab9a3d5aca2b020343b00a0201c593030498b5afe504af719a1585bf7a35ff10772a17
MD5 SHA1 SHA512

Submit Download

memory/1852-39-0x00007FFB6B500000-0x00007FFB6BFC1000-memory.dmp

Download

memory/1852-40-0x000000001B100000-0x000000001B110000-memory.dmp

Download

memory/1852-42-0x00007FFB6B500000-0x00007FFB6BFC1000-memory.dmp

Download

memory/1972-13-0x00007FFB6B500000-0x00007FFB6BFC1000-memory.dmp

Download

memory/1972-14-0x000000001B740000-0x000000001B750000-memory.dmp

Download

memory/1972-12-0x0000000000A50000-0x0000000000B26000-memory.dmp

Download

memory/1972-38-0x00007FFB6B500000-0x00007FFB6BFC1000-memory.dmp

Download