dcrat | 31ffe7c6379350a8abd75e69736fd081a58641823c4a6bf6d55fda547f360b72

General

Target
b70cc5cb44cf091e61262dffde9936d4.exe
Size 1.3MB
Sample240106-sk5s2scch2
SHA256 31ffe7c6379350a8abd75e69736fd081a58641823c4a6bf6d55fda547f360b72
MD5 b70cc5cb44cf091e61262dffde9936d4
SHA1 1088569fb495c04f490c2a8ab5a3af52e8d379e9
SHA512 c6c91c7bbd49c991d0d0be8ee4c55eb5f206b89c8e6e385258e12d7a95856af580dbe5aaa7234119eb4936bdac8b95136a737337c4cf444be1dbddf16326e96a
SSDEEP 24576:F2G/nvxW3WsnVbJN6SsyqzQ6uFIAdR1unjTKSx:FbA37VNN6fz5HXf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	2732	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2732	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	2732	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	2732	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2732	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	2732	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2732	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2732	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	2732	schtasks.exe	96

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2988-12-0x0000000000E10000-0x0000000000EE6000-memory.dmp	dcrat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2680	schtasks.exe
1100	schtasks.exe
4752	schtasks.exe
4732	schtasks.exe
2168	schtasks.exe
3176	schtasks.exe
3140	schtasks.exe
1608	schtasks.exe
1332	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\b70cc5cb44cf091e61262dffde9936d4.exe
"C:\Users\Admin\AppData\Local\Temp\b70cc5cb44cf091e61262dffde9936d4.exe"
1⤵
PID:3592
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\driverIntodhcp\cPCfwkcb0sVNZ9JNyPdicLBI6OCM.vbe"
  2⤵
  PID:944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\driverIntodhcp\nAadkmdUenlWZKJDOMq87fiLbb.bat" "
    3⤵
    PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\driverIntodhcp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Recovery\WindowsRE\WmiPrvSE.exe
"C:\Recovery\WindowsRE\WmiPrvSE.exe"
1⤵
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\driverIntodhcp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\driverIntodhcp\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\driverIntodhcp\bridgeinto.exe
"C:\driverIntodhcp\bridgeinto.exe"
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-12-0x0000000000E10000-0x0000000000EE6000-memory.dmp

Download

memory/2988-14-0x000000001BB00000-0x000000001BB10000-memory.dmp

Download

memory/2988-32-0x00007FF86BB20000-0x00007FF86C5E1000-memory.dmp

Download

memory/2988-13-0x00007FF86BB20000-0x00007FF86C5E1000-memory.dmp

Download

memory/4508-34-0x000000001B330000-0x000000001B340000-memory.dmp

Download

memory/4508-33-0x00007FF86BB20000-0x00007FF86C5E1000-memory.dmp

Download

memory/4508-35-0x00007FF86BB20000-0x00007FF86C5E1000-memory.dmp

Download

memory/4508-36-0x000000001B330000-0x000000001B340000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads