dcrat | e2d7af5ece97e32f2518977081188e7df2706e71a71d27dc739c68e0117542a6

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52840b21329e395164b93a484e12a024.exe
Size 2.1MB
Sample240111-expqpsedgr
SHA256 e2d7af5ece97e32f2518977081188e7df2706e71a71d27dc739c68e0117542a6
MD5 52840b21329e395164b93a484e12a024
SHA1 761833037303a70ee7058cdb2bef1ab6102dff6e
SHA512 87876036fc116f416cacab94be5269618723b0497be3b05698011dae26b55b1f5d391bc2808af11f78f4b5051f5259c27ffef2b73c2ebf989849df7ca7f6c81b
SSDEEP 24576:IYvhk8mtcbjQe0cjg+nufbNfLNsnop+4jYvhk8mtcbjQe0cjg+nufbNfLNsnop+4:R+W04184N+W04184
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2648-0-0x0000000000FD0000-0x00000000010E4000-memory.dmp	dcrat
behavioral1/files/0x0006000000016fba-11.dat	dcrat
behavioral1/files/0x0006000000016d47-16.dat	dcrat
behavioral1/memory/2584-17-0x0000000001290000-0x00000000013A4000-memory.dmp	dcrat
behavioral1/files/0x0006000000016d47-15.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2584	services.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\C_20278\winlogon.exe	52840b21329e395164b93a484e12a024.exe
File created	C:\Windows\System32\C_20278\cc11b995f2a76da408ea6a601e682e64743153ad	52840b21329e395164b93a484e12a024.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\fr-FR\spoolsv.exe	52840b21329e395164b93a484e12a024.exe
File created	C:\Program Files\Internet Explorer\fr-FR\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	52840b21329e395164b93a484e12a024.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\dwm.exe	52840b21329e395164b93a484e12a024.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\6cb0b6c459d5d3455a3da700e713f2e2529862ff	52840b21329e395164b93a484e12a024.exe
File created	C:\Program Files\Windows NT\Accessories\it-IT\services.exe	52840b21329e395164b93a484e12a024.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\it-IT\services.exe	52840b21329e395164b93a484e12a024.exe
File created	C:\Program Files\Windows NT\Accessories\it-IT\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d	52840b21329e395164b93a484e12a024.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2708	schtasks.exe
2328	schtasks.exe
2728	schtasks.exe
3000	schtasks.exe
2736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	52840b21329e395164b93a484e12a024.exe
2584	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	52840b21329e395164b93a484e12a024.exe
Token: SeDebugPrivilege	2584	services.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2708	2648	52840b21329e395164b93a484e12a024.exe	30
PID 2648 wrote to memory of 2708	2648	52840b21329e395164b93a484e12a024.exe	30
PID 2648 wrote to memory of 2708	2648	52840b21329e395164b93a484e12a024.exe	30
PID 2648 wrote to memory of 2328	2648	52840b21329e395164b93a484e12a024.exe	32
PID 2648 wrote to memory of 2328	2648	52840b21329e395164b93a484e12a024.exe	32
PID 2648 wrote to memory of 2328	2648	52840b21329e395164b93a484e12a024.exe	32
PID 2648 wrote to memory of 2728	2648	52840b21329e395164b93a484e12a024.exe	34
PID 2648 wrote to memory of 2728	2648	52840b21329e395164b93a484e12a024.exe	34
PID 2648 wrote to memory of 2728	2648	52840b21329e395164b93a484e12a024.exe	34
PID 2648 wrote to memory of 3000	2648	52840b21329e395164b93a484e12a024.exe	36
PID 2648 wrote to memory of 3000	2648	52840b21329e395164b93a484e12a024.exe	36
PID 2648 wrote to memory of 3000	2648	52840b21329e395164b93a484e12a024.exe	36
PID 2648 wrote to memory of 2736	2648	52840b21329e395164b93a484e12a024.exe	38
PID 2648 wrote to memory of 2736	2648	52840b21329e395164b93a484e12a024.exe	38
PID 2648 wrote to memory of 2736	2648	52840b21329e395164b93a484e12a024.exe	38
PID 2648 wrote to memory of 2584	2648	52840b21329e395164b93a484e12a024.exe	39
PID 2648 wrote to memory of 2584	2648	52840b21329e395164b93a484e12a024.exe	39
PID 2648 wrote to memory of 2584	2648	52840b21329e395164b93a484e12a024.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\52840b21329e395164b93a484e12a024.exe
"C:\Users\Admin\AppData\Local\Temp\52840b21329e395164b93a484e12a024.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\it-IT\services.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2708
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\spoolsv.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2328
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\dwm.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2728
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Downloads\services.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3000
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\C_20278\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2736
- C:\Users\Public\Downloads\services.exe
  "C:\Users\Public\Downloads\services.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\Users\Public\Downloads\services.exe
Size 577KB
SHA256 611d00ac552825d6497ed9c11e0f364ddcd821182980e65e78e8df760972430c
MD5 643721dcaee98a231b00aaa0cee9d26d
SHA1 dd8b47427e63cfe22c0224fc8343d0b7565b8318
SHA512 519903857a2f14f8bc5c396527017c69d1bcca3ecc87e21035b6c84ccd956a6fb01740c95de26f17bd82d4e52d2eef4908d421cbeadb9a98e54966b01db2abe5
SSDEEP 6144:jGZUACOiKFf7muJ30xBRv6gbk8b6DOu+2sa1T90LgufJbfDUGWM:jbAP5mnv6+k8m6udswkbjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\Users\Public\Downloads\services.exe
Size 541KB
SHA256 b795c7714d67a79c15a20cf56f3fd956b196a41eca2a6d360e947ca22061222f
MD5 a4cf7e1afe358d8af540eb35e3390a67
SHA1 e773fdd090e28ae67a815afc466bb73a2bbc6272
SHA512 59ca69a71c05496f95163138f33ee1b52686ca714101ab5efab9e9f00593499369165eeb5d966fad18a8cffe1a2e61bd5ceadc76e64904372fc35969ec0f9c17
SSDEEP 6144:jGZUACOiKFf7muJ30xBRv6gbk8b6DOu+2sa1T90LgufJbfDUGWT:jbAP5mnv6+k8m6udswkbj0
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\System32\C_20278\winlogon.exe
Size 939KB
SHA256 5d913bf161b89e80c61f51902bd976912bf59964aa43d032658067821b9cb868
MD5 f929de43d9d04c79f2885a50f47c0a91
SHA1 4e99579dd7cce44e0089753d13281e664157bf94
SHA512 819d57a39ce76067c3a8e5b83fd4274546f7d21affc269276e7cb677b3ca1fd8605740e77c913336cd4f1877b22787bf5625901a1fcacb30696ed3e65b174a33
SSDEEP 12288:jbAP5mnv6+k8m6udswkbjNWqH0cO+g+nufO8zUofPjh:IYvhk8mtcbjQe0cjg+nufbNfLh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2584-17-0x0000000001290000-0x00000000013A4000-memory.dmp

Download

memory/2584-18-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Download

memory/2584-20-0x00000000011F0000-0x0000000001270000-memory.dmp

Download

memory/2584-21-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Download

memory/2648-0-0x0000000000FD0000-0x00000000010E4000-memory.dmp

Download

memory/2648-1-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Download

memory/2648-2-0x000000001B080000-0x000000001B100000-memory.dmp

Download

memory/2648-19-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Download