dcrat | a41287634da9d9a649f39a728a77f7bfd8cda15ceb6938be1adfd557223fd97e

Analysis

max time kernel
153s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
50e6f5eefe74ac9696f53bccdef3669d.exe
Size 790KB
Sample240110-slr9caafd2
SHA256 a41287634da9d9a649f39a728a77f7bfd8cda15ceb6938be1adfd557223fd97e
MD5 50e6f5eefe74ac9696f53bccdef3669d
SHA1 96959d9d65eda7333a58a834a68ab752181bd56f
SHA512 afb86501769aada2d0a61314433866ad9557d5fe1fed090f123900ded78de3a6fd053d4e9c178ca05b7a6df6c45c730bc3e8531b7d39251a53cc1c852b8fc2f8
SSDEEP 12288:IW7ZCzf0wiWT60zCL3qn4nIgKHqzOOWjC6FWTgjUTtCesmsJ1xICbie:RGZ20a3+4INKzOOiC6FW1TtC7/Jbie
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2616	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2616	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2616	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	2616	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2616	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	2616	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	2616	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	2616	schtasks.exe	92

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2960-0-0x0000000000EA0000-0x0000000000F6C000-memory.dmp	dcrat
behavioral2/files/0x0006000000023220-16.dat	dcrat
behavioral2/files/0x000b000000023126-31.dat	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	50e6f5eefe74ac9696f53bccdef3669d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	50e6f5eefe74ac9696f53bccdef3669d.exe

Executes dropped EXE 1 IoCs

pid	Process
4284	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Defender\\es-ES\\OfficeClickToRun.exe\""	50e6f5eefe74ac9696f53bccdef3669d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\InputMethod\\SHARED\\csrss.exe\""	50e6f5eefe74ac9696f53bccdef3669d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\IHDS\\sihost.exe\""	50e6f5eefe74ac9696f53bccdef3669d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\DafDnsSd\\dllhost.exe\""	50e6f5eefe74ac9696f53bccdef3669d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\odt\\backgroundTaskHost.exe\""	50e6f5eefe74ac9696f53bccdef3669d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\PerfLogs\\RuntimeBroker.exe\""	50e6f5eefe74ac9696f53bccdef3669d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApp\\SearchApp.exe\""	50e6f5eefe74ac9696f53bccdef3669d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\PerfLogs\\winlogon.exe\""	50e6f5eefe74ac9696f53bccdef3669d.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\IHDS\sihost.exe	50e6f5eefe74ac9696f53bccdef3669d.exe
File created	C:\Windows\System32\IHDS\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3	50e6f5eefe74ac9696f53bccdef3669d.exe
File created	C:\Windows\System32\DafDnsSd\dllhost.exe	50e6f5eefe74ac9696f53bccdef3669d.exe
File created	C:\Windows\System32\DafDnsSd\5940a34987c99120d96dace90a3f93f329dcad63	50e6f5eefe74ac9696f53bccdef3669d.exe
File created	C:\Windows\System32\IHDS\sihost.exe	50e6f5eefe74ac9696f53bccdef3669d.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\es-ES\OfficeClickToRun.exe	50e6f5eefe74ac9696f53bccdef3669d.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\e6c9b481da804f07baff8eff543b0a1441069b5d	50e6f5eefe74ac9696f53bccdef3669d.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\InputMethod\SHARED\csrss.exe	50e6f5eefe74ac9696f53bccdef3669d.exe
File created	C:\Windows\InputMethod\SHARED\886983d96e3d3e31032c679b2d4ea91b6c05afef	50e6f5eefe74ac9696f53bccdef3669d.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp\SearchApp.exe	50e6f5eefe74ac9696f53bccdef3669d.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp\38384e6a620884a6b69bcc56f80d556f9200171c	50e6f5eefe74ac9696f53bccdef3669d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1144	schtasks.exe
1744	schtasks.exe
3448	schtasks.exe
1652	schtasks.exe
3420	schtasks.exe
4772	schtasks.exe
3904	schtasks.exe
1236	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	50e6f5eefe74ac9696f53bccdef3669d.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2960	50e6f5eefe74ac9696f53bccdef3669d.exe
4120	50e6f5eefe74ac9696f53bccdef3669d.exe
4284	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	50e6f5eefe74ac9696f53bccdef3669d.exe
Token: SeDebugPrivilege	4120	50e6f5eefe74ac9696f53bccdef3669d.exe
Token: SeDebugPrivilege	4284	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4120	2960	50e6f5eefe74ac9696f53bccdef3669d.exe	97
PID 2960 wrote to memory of 4120	2960	50e6f5eefe74ac9696f53bccdef3669d.exe	97
PID 4120 wrote to memory of 1356	4120	50e6f5eefe74ac9696f53bccdef3669d.exe	104
PID 4120 wrote to memory of 1356	4120	50e6f5eefe74ac9696f53bccdef3669d.exe	104
PID 1356 wrote to memory of 3856	1356	cmd.exe	108
PID 1356 wrote to memory of 3856	1356	cmd.exe	108
PID 1356 wrote to memory of 4340	1356	cmd.exe	109
PID 1356 wrote to memory of 4340	1356	cmd.exe	109
PID 1356 wrote to memory of 4284	1356	cmd.exe	112
PID 1356 wrote to memory of 4284	1356	cmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\50e6f5eefe74ac9696f53bccdef3669d.exe
"C:\Users\Admin\AppData\Local\Temp\50e6f5eefe74ac9696f53bccdef3669d.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\50e6f5eefe74ac9696f53bccdef3669d.exe
  "C:\Users\Admin\AppData\Local\Temp\50e6f5eefe74ac9696f53bccdef3669d.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kic96rooDU.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3856
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:4340
  - - C:\PerfLogs\RuntimeBroker.exe
      "C:\PerfLogs\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\IHDS\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\DafDnsSd\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\PerfLogs\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\PerfLogs\RuntimeBroker.exe
Size 790KB
SHA256 a41287634da9d9a649f39a728a77f7bfd8cda15ceb6938be1adfd557223fd97e
MD5 50e6f5eefe74ac9696f53bccdef3669d
SHA1 96959d9d65eda7333a58a834a68ab752181bd56f
SHA512 afb86501769aada2d0a61314433866ad9557d5fe1fed090f123900ded78de3a6fd053d4e9c178ca05b7a6df6c45c730bc3e8531b7d39251a53cc1c852b8fc2f8
SSDEEP 12288:IW7ZCzf0wiWT60zCL3qn4nIgKHqzOOWjC6FWTgjUTtCesmsJ1xICbie:RGZ20a3+4INKzOOiC6FW1TtC7/Jbie
MD5 SHA1 SHA512 SSDEEP

Submit Download

50e6f5eefe74ac9696f53bccdef3669d.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\50e6f5eefe74ac9696f53bccdef3669d.exe.log
Size 1KB
SHA256 46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457
MD5 b7c0c43fc7804baaa7dc87152cdc9554
SHA1 1bab62bd56af745678d4e967d91e1ccfdeed4038
SHA512 9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769
MD5 SHA1 SHA512

Submit Download

Kic96rooDU.bat

Path C:\Users\Admin\AppData\Local\Temp\Kic96rooDU.bat
Size 245B
SHA256 0a1feff02daa0f0194e4539e3e8298231b9575d490af31378433c7c39d683de4
MD5 fde3fb300eca9977187d141bad8bb6af
SHA1 d6c98475c1cf959b5228cd55165b997598e41d3e
SHA512 8c5dafb9a00e87444b1573b53908acd4fa8db19ad09f76727613cb4bee3b5aaecbf0b6bbde20c3eba1501a083e072f2747920a0e9ad7a8b8b53cd9c8a564bebb
MD5 SHA1 SHA512

Submit Download

SearchApp.exe

Path C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp\SearchApp.exe
Size 166KB
SHA256 5f9b08430d4f7f4fe46eac6fdd5082a9a6811ee31996c205a122ebde4e0ff996
MD5 3efec6eda1301e91606dd5c373c543f5
SHA1 b7050e1f05a7abd4479aa6227a50a739dece85af
SHA512 08960a938948e522928fd84d2946cc7bd727ce75f5bee2512f1ff3fde981adc84e0ce772ce0cebb0a581e0d7596da0809a6d37672377a42fd99f1b00161ca90f
SSDEEP 3072:ILUh6Ln2CvV96UeWNS3R+5ab8Ds7PX85nWaz7Rt2wzDfc9+YwgyjWcgn12T6cmpr:ILi6Ln2CvVkgNS30ab8Ds7Psxhz7/f0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2960-2-0x000000001BB50000-0x000000001BB60000-memory.dmp

Download

memory/2960-11-0x00007FF8FCFB0000-0x00007FF8FDA71000-memory.dmp

Download

memory/2960-0-0x0000000000EA0000-0x0000000000F6C000-memory.dmp

Download

memory/2960-1-0x00007FF8FCFB0000-0x00007FF8FDA71000-memory.dmp

Download

memory/4120-12-0x00007FF8FCFB0000-0x00007FF8FDA71000-memory.dmp

Download

memory/4120-13-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

Download

memory/4120-28-0x00007FF8FCFB0000-0x00007FF8FDA71000-memory.dmp

Download

memory/4284-33-0x00007FF8FCF00000-0x00007FF8FD9C1000-memory.dmp

Download

memory/4284-35-0x00007FF8FCF00000-0x00007FF8FD9C1000-memory.dmp

Download