dcrat | 82c160832568258001ad498291a7c3b6f0500bdd1f93153d8ae1b0e3b9033e44

General

Target

1c5beacf795033142fa3ed081ada1b30.exe
Size

1.2MB
MD5

1c5beacf795033142fa3ed081ada1b30
SHA1

2e38208dfd2bf4b52e82359cd5101d08667e5b4c
SHA256

82c160832568258001ad498291a7c3b6f0500bdd1f93153d8ae1b0e3b9033e44
SHA512

42540ac45358cbaf44d7148dd6f64dc9cd45ccdcf50b3550c1c02eb9e2e1098f05d92f3630abdee4e6d9bed35c389768e98680fd7a406a7d35c09abe5f8e7634
SSDEEP

24576:Rm0INy7ki6HAYWbNAtjrpMlcOV+3xNFTG+FWx+4:MC7h6HIAtltxDG+J

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3912-0-0x0000000000E30000-0x0000000000F64000-memory.dmp	dcrat
behavioral2/files/0x000300000001e808-12.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	1c5beacf795033142fa3ed081ada1b30.exe

Executes dropped EXE 1 IoCs

pid	Process
4640	WmiPrvSE.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\ProximityCommon\\fontdrvhost.exe\""	1c5beacf795033142fa3ed081ada1b30.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\wbem\EventTracingManagement\24dbde2999530ef5fd907494bc374d663924116c	1c5beacf795033142fa3ed081ada1b30.exe
File created	C:\Windows\System32\ProximityCommon\fontdrvhost.exe	1c5beacf795033142fa3ed081ada1b30.exe
File opened for modification	C:\Windows\System32\ProximityCommon\fontdrvhost.exe	1c5beacf795033142fa3ed081ada1b30.exe
File created	C:\Windows\System32\ProximityCommon\5b884080fd4f94e2695da25c503f9e33b9605b83	1c5beacf795033142fa3ed081ada1b30.exe
File created	C:\Windows\System32\backgroundTaskHost\RuntimeBroker.exe	1c5beacf795033142fa3ed081ada1b30.exe
File created	C:\Windows\System32\backgroundTaskHost\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	1c5beacf795033142fa3ed081ada1b30.exe
File created	C:\Windows\System32\wbem\EventTracingManagement\WmiPrvSE.exe	1c5beacf795033142fa3ed081ada1b30.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk\e6c9b481da804f07baff8eff543b0a1441069b5d	1c5beacf795033142fa3ed081ada1b30.exe
File created	C:\Program Files (x86)\Google\CrashReports\wininit.exe	1c5beacf795033142fa3ed081ada1b30.exe
File created	C:\Program Files (x86)\Google\CrashReports\560854153607923c4c5f107085a7db67be01f252	1c5beacf795033142fa3ed081ada1b30.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk\OfficeClickToRun.exe	1c5beacf795033142fa3ed081ada1b30.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1516	schtasks.exe
116	schtasks.exe
4468	schtasks.exe
3524	schtasks.exe
1412	schtasks.exe
3092	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	1c5beacf795033142fa3ed081ada1b30.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1156	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3912	1c5beacf795033142fa3ed081ada1b30.exe
3912	1c5beacf795033142fa3ed081ada1b30.exe
3912	1c5beacf795033142fa3ed081ada1b30.exe
3912	1c5beacf795033142fa3ed081ada1b30.exe
3912	1c5beacf795033142fa3ed081ada1b30.exe
4640	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	1c5beacf795033142fa3ed081ada1b30.exe
Token: SeDebugPrivilege	4640	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 1516	3912	1c5beacf795033142fa3ed081ada1b30.exe	96
PID 3912 wrote to memory of 1516	3912	1c5beacf795033142fa3ed081ada1b30.exe	96
PID 3912 wrote to memory of 116	3912	1c5beacf795033142fa3ed081ada1b30.exe	99
PID 3912 wrote to memory of 116	3912	1c5beacf795033142fa3ed081ada1b30.exe	99
PID 3912 wrote to memory of 4468	3912	1c5beacf795033142fa3ed081ada1b30.exe	101
PID 3912 wrote to memory of 4468	3912	1c5beacf795033142fa3ed081ada1b30.exe	101
PID 3912 wrote to memory of 3524	3912	1c5beacf795033142fa3ed081ada1b30.exe	103
PID 3912 wrote to memory of 3524	3912	1c5beacf795033142fa3ed081ada1b30.exe	103
PID 3912 wrote to memory of 1412	3912	1c5beacf795033142fa3ed081ada1b30.exe	105
PID 3912 wrote to memory of 1412	3912	1c5beacf795033142fa3ed081ada1b30.exe	105
PID 3912 wrote to memory of 3092	3912	1c5beacf795033142fa3ed081ada1b30.exe	107
PID 3912 wrote to memory of 3092	3912	1c5beacf795033142fa3ed081ada1b30.exe	107
PID 3912 wrote to memory of 3052	3912	1c5beacf795033142fa3ed081ada1b30.exe	109
PID 3912 wrote to memory of 3052	3912	1c5beacf795033142fa3ed081ada1b30.exe	109
PID 3052 wrote to memory of 2148	3052	cmd.exe	111
PID 3052 wrote to memory of 2148	3052	cmd.exe	111
PID 3052 wrote to memory of 1156	3052	cmd.exe	112
PID 3052 wrote to memory of 1156	3052	cmd.exe	112
PID 3052 wrote to memory of 4640	3052	cmd.exe	113
PID 3052 wrote to memory of 4640	3052	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1c5beacf795033142fa3ed081ada1b30.exe
"C:\Users\Admin\AppData\Local\Temp\1c5beacf795033142fa3ed081ada1b30.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\ProximityCommon\fontdrvhost.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1516
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\backgroundTaskHost\RuntimeBroker.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:116
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk\OfficeClickToRun.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:4468
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\PerfLogs\smss.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3524
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\EventTracingManagement\WmiPrvSE.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1412
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\wininit.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NgE58zVcDC.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2148
- - C:\Windows\system32\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:1156
- - C:\Windows\System32\wbem\EventTracingManagement\WmiPrvSE.exe
    "C:\Windows\System32\wbem\EventTracingManagement\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NgE58zVcDC.bat

Filesize
226B

MD5
5832c591ac89b0c5d8f8ce156277f78e

SHA1
36124d60185d240f41a6f388fac12685d689fa65

SHA256
c56acc940b57fbf00884576b9539b96ca02c4a07ab48c9d20a5d65dc8b4bc895

SHA512
3a9ae9a9bd3e3007bdc9ff6912debe9f41754d8dcd0dcc3f8ee47645c9bba1e4a1ec5e92baf67237c2ae5f85e5f3c234edbffbc97f2e9cd941c5e2130aeafa73

Download Submit
C:\Windows\System32\wbem\EventTracingManagement\WmiPrvSE.exe

Filesize
1.2MB

MD5
1c5beacf795033142fa3ed081ada1b30

SHA1
2e38208dfd2bf4b52e82359cd5101d08667e5b4c

SHA256
82c160832568258001ad498291a7c3b6f0500bdd1f93153d8ae1b0e3b9033e44

SHA512
42540ac45358cbaf44d7148dd6f64dc9cd45ccdcf50b3550c1c02eb9e2e1098f05d92f3630abdee4e6d9bed35c389768e98680fd7a406a7d35c09abe5f8e7634

Download Submit
memory/3912-0-0x0000000000E30000-0x0000000000F64000-memory.dmp

Filesize
1.2MB

Download
memory/3912-1-0x00007FFC8D6B0000-0x00007FFC8E171000-memory.dmp

Filesize
10.8MB

Download
memory/3912-2-0x00007FFC8D6B0000-0x00007FFC8E171000-memory.dmp

Filesize
10.8MB

Download
memory/3912-3-0x000000001BCE0000-0x000000001BCF0000-memory.dmp

Filesize
64KB

Download
memory/3912-21-0x00007FFC8D6B0000-0x00007FFC8E171000-memory.dmp

Filesize
10.8MB

Download
memory/4640-26-0x00007FFC8D730000-0x00007FFC8E1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4640-27-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/4640-28-0x00007FFC8D730000-0x00007FFC8E1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4640-29-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/4640-31-0x00007FFC8D730000-0x00007FFC8E1F1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads