dcrat | fd9e479531a11076bfa97269d4562bda4571f3f03f00e049e3e125d82099e942

Resubmissions

10/01/2024, 04:58

240110-fl152aeafn10

10/01/2024, 04:00

240110-ek33kaddbl10

Analysis

max time kernel
185s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f85fd9da0e6d825b520f09905b16301.exe
Size 1.1MB
Sample240110-ek33kaddbl
SHA256 fd9e479531a11076bfa97269d4562bda4571f3f03f00e049e3e125d82099e942
MD5 4f85fd9da0e6d825b520f09905b16301
SHA1 11b96ca925a09cd96569c4be2930b9b2bad9dd07
SHA512 cd7d31d8cec1f0aca5597216baffa5fbdaa7b4cf8134f8b0de7f2ed0b97c24c5964cf0508dc115360d5264e093436081970d7acfa6917e0d1a14d34a4774003e
SSDEEP 24576:TGyavpdrgnar7l2odPdcsZHpa+AGO05d2GqXW+lWR++4:wlr7tcsZHpaVwulm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	1512	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1512	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1512	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	1512	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	1512	schtasks.exe	88

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2912-0-0x0000000000DF0000-0x0000000000F12000-memory.dmp	dcrat
behavioral2/files/0x0006000000023233-12.dat	dcrat
behavioral2/files/0x0006000000023220-24.dat	dcrat
behavioral2/files/0x0006000000023220-23.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	4f85fd9da0e6d825b520f09905b16301.exe

Executes dropped EXE 1 IoCs

pid	Process
3192	dllhost.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\mfc100chs\\RuntimeBroker.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\krnlprov\\unsecapp.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\Windows.Globalization.Fontgroups\\RuntimeBroker.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\WordBreakers\\dllhost.exe\""	4f85fd9da0e6d825b520f09905b16301.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\WordBreakers\dllhost.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\mfc100chs\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\wbem\krnlprov\unsecapp.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\wbem\krnlprov\29c1c3cc0f76855c7e7456076a4ffc27e4947119	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\Windows.Globalization.Fontgroups\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	4f85fd9da0e6d825b520f09905b16301.exe
File opened for modification	C:\Windows\System32\WordBreakers\dllhost.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\WordBreakers\5940a34987c99120d96dace90a3f93f329dcad63	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\mfc100chs\RuntimeBroker.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\Windows.Globalization.Fontgroups\RuntimeBroker.exe	4f85fd9da0e6d825b520f09905b16301.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4804	schtasks.exe
2668	schtasks.exe
1920	schtasks.exe
3084	schtasks.exe
4012	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	4f85fd9da0e6d825b520f09905b16301.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2912	4f85fd9da0e6d825b520f09905b16301.exe
2912	4f85fd9da0e6d825b520f09905b16301.exe
2912	4f85fd9da0e6d825b520f09905b16301.exe
2912	4f85fd9da0e6d825b520f09905b16301.exe
2912	4f85fd9da0e6d825b520f09905b16301.exe
2912	4f85fd9da0e6d825b520f09905b16301.exe
2912	4f85fd9da0e6d825b520f09905b16301.exe
3192	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	4f85fd9da0e6d825b520f09905b16301.exe
Token: SeDebugPrivilege	3192	dllhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3196	2912	4f85fd9da0e6d825b520f09905b16301.exe	99
PID 2912 wrote to memory of 3196	2912	4f85fd9da0e6d825b520f09905b16301.exe	99
PID 3196 wrote to memory of 4672	3196	cmd.exe	98
PID 3196 wrote to memory of 4672	3196	cmd.exe	98
PID 3196 wrote to memory of 2804	3196	cmd.exe	100
PID 3196 wrote to memory of 2804	3196	cmd.exe	100
PID 3196 wrote to memory of 3192	3196	cmd.exe	103
PID 3196 wrote to memory of 3192	3196	cmd.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4f85fd9da0e6d825b520f09905b16301.exe
"C:\Users\Admin\AppData\Local\Temp\4f85fd9da0e6d825b520f09905b16301.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U5BWjZm0GW.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2804
- - C:\Windows\System32\WordBreakers\dllhost.exe
    "C:\Windows\System32\WordBreakers\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\WordBreakers\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\mfc100chs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\krnlprov\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\Windows.Globalization.Fontgroups\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4012

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Recovery\WindowsRE\csrss.exe
Size 514KB
SHA256 7dcc077d76d969300afdea462fb193199c4596a863bd135af15d8d43bd9aa6b2
MD5 282fa3b3671abcb3f7541e9087e9888d
SHA1 63c23c1e36892c4ea4710547c6c546dd2228995b
SHA512 d310376d5a736ec6666063ed03e29555196e87d7d6e5f8d4eddea4fe5f8adf6f1537790827301b84475d586334470a80ffebf695e7b7ddaa2c85f5dbeabd40e5
SSDEEP 6144:w8v+yjGvpowrheruqBolSgJsa7llT8/3odSZf:w8GyjGvpdrgngJr7lGPodE
MD5 SHA1 SHA512 SSDEEP

Submit Download

U5BWjZm0GW.bat

Path C:\Users\Admin\AppData\Local\Temp\U5BWjZm0GW.bat
Size 260B
SHA256 28fb253e379dcef2b7576ab423818db5836f44c5e9d5666f331ea0dd116b2d53
MD5 c6b808d1a627c38b125fbcfd889a161d
SHA1 0d91c0b208c8e6ddf731521f16bb3dafa2bba1aa
SHA512 a25287815a631c062310638d76015641462e8280eb713bdc24886a8f64fe75131d36c4c318728e52dd1a9cee7bdc2a2ce0826218db475b9b6e87229cc3ce7162
MD5 SHA1 SHA512

Submit Download

dllhost.exe

Path C:\Windows\System32\WordBreakers\dllhost.exe
Size 232KB
SHA256 0daa53eb4e788017d4f0521221e7a1de352252f43fed612b7fe5c6fe8abdf3c2
MD5 4d6a33ee6633d8372ee4f7db46b246da
SHA1 1794a9e5bf6ad370313e940ba3e85263b00c0d74
SHA512 76c30d8969920ac10144f897c665952444e7f12313e739fd18670ea2afa34b5db70bfcfb94c27c3a8004a1ee1d7393b6ceddbdd796066d958623ebe9314028d8
SSDEEP 3072:QFjR8v+ySUUxDrpFACqOkGG0Sw+6j+oyi:w8v+yjGvpowrhR
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path C:\Windows\System32\WordBreakers\dllhost.exe
Size 554KB
SHA256 58e2020dfeb0c827522ac4a953dbc62c9ae56a22c4893e0553b4f31ca6ee9a5b
MD5 d64e4476309b03f7712ddd172255214c
SHA1 bb5bbc9faaa91c8d4bfeb3b0ae01c29d5806129e
SHA512 68dd6848da6e4013cdaf3cab9c34bce50367c7f7700e012dbd5517b7ee2b336881b7af962087b626a7d6c78ff390ec2e15a64a8a65ee6de4e955d28fa15daf4f
SSDEEP 6144:w8v+yjGvpowrheruqBolSgJsa7llT8/3odSZMd9CC:w8GyjGvpdrgngJr7lGPodPdcC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2912-8-0x00007FFE08950000-0x00007FFE09411000-memory.dmp

Download

memory/2912-14-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Download

memory/2912-0-0x0000000000DF0000-0x0000000000F12000-memory.dmp

Download

memory/2912-21-0x00007FFE08950000-0x00007FFE09411000-memory.dmp

Download

memory/2912-2-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Download

memory/2912-1-0x00007FFE08950000-0x00007FFE09411000-memory.dmp

Download

memory/3192-26-0x000000001B0D0000-0x000000001B0E0000-memory.dmp

Download

memory/3192-25-0x00007FFE07650000-0x00007FFE08111000-memory.dmp

Download

memory/3192-27-0x00007FFE07650000-0x00007FFE08111000-memory.dmp

Download

memory/3192-28-0x000000001B0D0000-0x000000001B0E0000-memory.dmp

Download

memory/3192-30-0x00007FFE07650000-0x00007FFE08111000-memory.dmp

Download