dcrat | dea61d766eabdc5e8a11be7eec12c2d0670be8fb98e6632fac67fc478061318b

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5537aec6cdd2be7bd105e31b272ade57.exe
Size 1.2MB
Sample240112-crst3adff2
SHA256 dea61d766eabdc5e8a11be7eec12c2d0670be8fb98e6632fac67fc478061318b
MD5 5537aec6cdd2be7bd105e31b272ade57
SHA1 9b393bdeccc6d8d4d1f570604d1d17f4d3111825
SHA512 4f39b2b808bceb459e71b1675bbbef72fc7725fd4d030bcd99e11d164a2e2905add549597c4ffe3b1fa9c80d75d1f0363d8127091f2e283952d1d7ef33521c51
SSDEEP 24576:2xFuJDgnXQVrkhc7LSxmZHDI4iZ+adwD6OrM1ZK13fDSZge+4:ZgnXQVOxmVradfZ7K1P2Zi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2716	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	2716	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2716	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2716	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2716	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2716	schtasks.exe	28

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2000-0-0x0000000001160000-0x000000000129E000-memory.dmp	dcrat
behavioral1/files/0x0006000000016d08-13.dat	dcrat
behavioral1/memory/1524-25-0x0000000000910000-0x0000000000A4E000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1524	wininit.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\setuperr\\explorer.exe\""	5537aec6cdd2be7bd105e31b272ade57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\nlmgp\\dwm.exe\""	5537aec6cdd2be7bd105e31b272ade57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\wininit\\spoolsv.exe\""	5537aec6cdd2be7bd105e31b272ade57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Documents and Settings\\wininit.exe\""	5537aec6cdd2be7bd105e31b272ade57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\dot3svc\\csrss.exe\""	5537aec6cdd2be7bd105e31b272ade57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\PerfLogs\\Admin\\winlogon.exe\""	5537aec6cdd2be7bd105e31b272ade57.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\nlmgp\dwm.exe	5537aec6cdd2be7bd105e31b272ade57.exe
File created	C:\Windows\System32\nlmgp\6cb0b6c459d5d3455a3da700e713f2e2529862ff	5537aec6cdd2be7bd105e31b272ade57.exe
File created	C:\Windows\System32\wininit\spoolsv.exe	5537aec6cdd2be7bd105e31b272ade57.exe
File opened for modification	C:\Windows\System32\wininit\spoolsv.exe	5537aec6cdd2be7bd105e31b272ade57.exe
File created	C:\Windows\System32\wininit\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	5537aec6cdd2be7bd105e31b272ade57.exe
File created	C:\Windows\System32\dot3svc\csrss.exe	5537aec6cdd2be7bd105e31b272ade57.exe
File created	C:\Windows\System32\dot3svc\886983d96e3d3e31032c679b2d4ea91b6c05afef	5537aec6cdd2be7bd105e31b272ade57.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\setuperr\explorer.exe	5537aec6cdd2be7bd105e31b272ade57.exe
File created	C:\Windows\setuperr\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	5537aec6cdd2be7bd105e31b272ade57.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3024	schtasks.exe
2324	schtasks.exe
2968	schtasks.exe
1076	schtasks.exe
2796	schtasks.exe
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2000	5537aec6cdd2be7bd105e31b272ade57.exe
2668	5537aec6cdd2be7bd105e31b272ade57.exe
2668	5537aec6cdd2be7bd105e31b272ade57.exe
2668	5537aec6cdd2be7bd105e31b272ade57.exe
1524	wininit.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	5537aec6cdd2be7bd105e31b272ade57.exe
Token: SeDebugPrivilege	2668	5537aec6cdd2be7bd105e31b272ade57.exe
Token: SeDebugPrivilege	1524	wininit.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2668	2000	5537aec6cdd2be7bd105e31b272ade57.exe	32
PID 2000 wrote to memory of 2668	2000	5537aec6cdd2be7bd105e31b272ade57.exe	32
PID 2000 wrote to memory of 2668	2000	5537aec6cdd2be7bd105e31b272ade57.exe	32
PID 2668 wrote to memory of 2168	2668	5537aec6cdd2be7bd105e31b272ade57.exe	36
PID 2668 wrote to memory of 2168	2668	5537aec6cdd2be7bd105e31b272ade57.exe	36
PID 2668 wrote to memory of 2168	2668	5537aec6cdd2be7bd105e31b272ade57.exe	36
PID 2168 wrote to memory of 788	2168	cmd.exe	38
PID 2168 wrote to memory of 788	2168	cmd.exe	38
PID 2168 wrote to memory of 788	2168	cmd.exe	38
PID 2168 wrote to memory of 1184	2168	cmd.exe	39
PID 2168 wrote to memory of 1184	2168	cmd.exe	39
PID 2168 wrote to memory of 1184	2168	cmd.exe	39
PID 2168 wrote to memory of 1524	2168	cmd.exe	40
PID 2168 wrote to memory of 1524	2168	cmd.exe	40
PID 2168 wrote to memory of 1524	2168	cmd.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5537aec6cdd2be7bd105e31b272ade57.exe
"C:\Users\Admin\AppData\Local\Temp\5537aec6cdd2be7bd105e31b272ade57.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\5537aec6cdd2be7bd105e31b272ade57.exe
  "C:\Users\Admin\AppData\Local\Temp\5537aec6cdd2be7bd105e31b272ade57.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\njUIXH2EI2.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:788
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:1184
  - - C:\Documents and Settings\wininit.exe
      "C:\Documents and Settings\wininit.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\PerfLogs\Admin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\setuperr\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\nlmgp\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\wininit\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Documents and Settings\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\dot3svc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

njUIXH2EI2.bat

Path C:\Users\Admin\AppData\Local\Temp\njUIXH2EI2.bat
Size 253B
SHA256 0e5bd1b0f7e7b5f77575aada0c9083712c6447eb23ab73481e312ebc17bcda52
MD5 3db5f2d83239221253cbf69c645b7fed
SHA1 575ae82af4483be5ce3592a3b7fabbbd655443a8
SHA512 545f2dbf3fc809306d1ae69579f0b8c3d440c91ce5e9ecbda4630024a0fd1282c2b1f127019ac7d752c186b903b507a37becb470797b4debc4286f4633451a6c
MD5 SHA1 SHA512

Submit Download

wininit.exe

Path C:\Users\wininit.exe
Size 1.2MB
SHA256 dea61d766eabdc5e8a11be7eec12c2d0670be8fb98e6632fac67fc478061318b
MD5 5537aec6cdd2be7bd105e31b272ade57
SHA1 9b393bdeccc6d8d4d1f570604d1d17f4d3111825
SHA512 4f39b2b808bceb459e71b1675bbbef72fc7725fd4d030bcd99e11d164a2e2905add549597c4ffe3b1fa9c80d75d1f0363d8127091f2e283952d1d7ef33521c51
SSDEEP 24576:2xFuJDgnXQVrkhc7LSxmZHDI4iZ+adwD6OrM1ZK13fDSZge+4:ZgnXQVOxmVradfZ7K1P2Zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1524-26-0x000007FEF49D0000-0x000007FEF53BC000-memory.dmp

Download

memory/1524-25-0x0000000000910000-0x0000000000A4E000-memory.dmp

Download

memory/1524-27-0x000000001AEB0000-0x000000001AF30000-memory.dmp

Download

memory/1524-28-0x000007FEF49D0000-0x000007FEF53BC000-memory.dmp

Download

memory/2000-2-0x000000001B240000-0x000000001B2C0000-memory.dmp

Download

memory/2000-1-0x000007FEF6100000-0x000007FEF6AEC000-memory.dmp

Download

memory/2000-0-0x0000000001160000-0x000000000129E000-memory.dmp

Download

memory/2000-29-0x000007FEF6100000-0x000007FEF6AEC000-memory.dmp

Download

memory/2668-9-0x000007FEF6100000-0x000007FEF6AEC000-memory.dmp

Download

memory/2668-10-0x000000001B1E0000-0x000000001B260000-memory.dmp

Download

memory/2668-22-0x000007FEF6100000-0x000007FEF6AEC000-memory.dmp

Download