dcrat | da1882cb18018f29cc929dc11712914db85f102bccc49ec4a1fe38d6c456865d

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6124089b7b0428e2a09768821072b465.exe
Size 2.0MB
Sample240116-3dlrpsdeb6
SHA256 da1882cb18018f29cc929dc11712914db85f102bccc49ec4a1fe38d6c456865d
MD5 6124089b7b0428e2a09768821072b465
SHA1 6b854419f158d327694bd3e44030e161b622f278
SHA512 a7c4e20b3ba80cfc9ee51afa0547ba39564d69a711e116f20c0954527b7c0a12764568b5b65fd0aafc08bf57f02af00e67966431e2b79d51d68897b71302e137
SSDEEP 49152:YsY5OcNp20ou2r4HeXZspkNgtwVziGyeHanhcHoGzRg:RY5T1x6ZseNkwZiGInhRyRg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	3716	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	3716	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	3716	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3544	3716	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	3716	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	3716	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	3716	schtasks.exe	92

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3472-14-0x0000000000400000-0x0000000000564000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	6124089b7b0428e2a09768821072b465.exe

Executes dropped EXE 5 IoCs

pid	Process
2388	fontdrvhost.exe
732	fontdrvhost.exe
4376	fontdrvhost.exe
5092	fontdrvhost.exe
2300	fontdrvhost.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\odt\\Idle.exe\""	6124089b7b0428e2a09768821072b465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\d3dxof\\winlogon.exe\""	6124089b7b0428e2a09768821072b465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\asferror\\fontdrvhost.exe\""	6124089b7b0428e2a09768821072b465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\""	6124089b7b0428e2a09768821072b465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6124089b7b0428e2a09768821072b465 = "\"C:\\Users\\Default User\\6124089b7b0428e2a09768821072b465.exe\""	6124089b7b0428e2a09768821072b465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\dui70\\SppExtComObj.exe\""	6124089b7b0428e2a09768821072b465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\wuapi\\SppExtComObj.exe\""	6124089b7b0428e2a09768821072b465.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dui70\SppExtComObj.exe	6124089b7b0428e2a09768821072b465.exe
File opened for modification	C:\Windows\SysWOW64\dui70\SppExtComObj.exe	6124089b7b0428e2a09768821072b465.exe
File created	C:\Windows\SysWOW64\dui70\e1ef82546f0b02b7e974f28047f3788b1128cce1	6124089b7b0428e2a09768821072b465.exe
File created	C:\Windows\SysWOW64\wuapi\SppExtComObj.exe	6124089b7b0428e2a09768821072b465.exe
File created	C:\Windows\SysWOW64\d3dxof\winlogon.exe	6124089b7b0428e2a09768821072b465.exe
File created	C:\Windows\SysWOW64\asferror\5b884080fd4f94e2695da25c503f9e33b9605b83	6124089b7b0428e2a09768821072b465.exe
File created	C:\Windows\SysWOW64\wuapi\e1ef82546f0b02b7e974f28047f3788b1128cce1	6124089b7b0428e2a09768821072b465.exe
File created	C:\Windows\SysWOW64\d3dxof\cc11b995f2a76da408ea6a601e682e64743153ad	6124089b7b0428e2a09768821072b465.exe
File created	C:\Windows\SysWOW64\asferror\fontdrvhost.exe	6124089b7b0428e2a09768821072b465.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 2388 set thread context of 2300	2388	fontdrvhost.exe	109

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe	6124089b7b0428e2a09768821072b465.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\22eafd247d37c30fed3795ee41d259ec72bb351c	6124089b7b0428e2a09768821072b465.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
452	schtasks.exe
4712	schtasks.exe
3544	schtasks.exe
116	schtasks.exe
3464	schtasks.exe
2476	schtasks.exe
5052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3472	6124089b7b0428e2a09768821072b465.exe
2388	fontdrvhost.exe
2388	fontdrvhost.exe
2388	fontdrvhost.exe
2388	fontdrvhost.exe
2388	fontdrvhost.exe
2388	fontdrvhost.exe
2300	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3472	6124089b7b0428e2a09768821072b465.exe
Token: SeDebugPrivilege	2388	fontdrvhost.exe
Token: SeDebugPrivilege	2300	fontdrvhost.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 4796 wrote to memory of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 4796 wrote to memory of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 4796 wrote to memory of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 4796 wrote to memory of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 4796 wrote to memory of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 4796 wrote to memory of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 4796 wrote to memory of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 4796 wrote to memory of 3472	4796	6124089b7b0428e2a09768821072b465.exe	97
PID 3472 wrote to memory of 2388	3472	6124089b7b0428e2a09768821072b465.exe	105
PID 3472 wrote to memory of 2388	3472	6124089b7b0428e2a09768821072b465.exe	105
PID 3472 wrote to memory of 2388	3472	6124089b7b0428e2a09768821072b465.exe	105
PID 2388 wrote to memory of 732	2388	fontdrvhost.exe	106
PID 2388 wrote to memory of 732	2388	fontdrvhost.exe	106
PID 2388 wrote to memory of 732	2388	fontdrvhost.exe	106
PID 2388 wrote to memory of 4376	2388	fontdrvhost.exe	107
PID 2388 wrote to memory of 4376	2388	fontdrvhost.exe	107
PID 2388 wrote to memory of 4376	2388	fontdrvhost.exe	107
PID 2388 wrote to memory of 5092	2388	fontdrvhost.exe	108
PID 2388 wrote to memory of 5092	2388	fontdrvhost.exe	108
PID 2388 wrote to memory of 5092	2388	fontdrvhost.exe	108
PID 2388 wrote to memory of 2300	2388	fontdrvhost.exe	109
PID 2388 wrote to memory of 2300	2388	fontdrvhost.exe	109
PID 2388 wrote to memory of 2300	2388	fontdrvhost.exe	109
PID 2388 wrote to memory of 2300	2388	fontdrvhost.exe	109
PID 2388 wrote to memory of 2300	2388	fontdrvhost.exe	109
PID 2388 wrote to memory of 2300	2388	fontdrvhost.exe	109
PID 2388 wrote to memory of 2300	2388	fontdrvhost.exe	109
PID 2388 wrote to memory of 2300	2388	fontdrvhost.exe	109
PID 2388 wrote to memory of 2300	2388	fontdrvhost.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6124089b7b0428e2a09768821072b465.exe
"C:\Users\Admin\AppData\Local\Temp\6124089b7b0428e2a09768821072b465.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\6124089b7b0428e2a09768821072b465.exe
  "C:\Users\Admin\AppData\Local\Temp\6124089b7b0428e2a09768821072b465.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\asferror\fontdrvhost.exe
    "C:\Windows\System32\asferror\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\SysWOW64\asferror\fontdrvhost.exe
      "C:\Windows\SysWOW64\asferror\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      PID:732
  - - C:\Windows\SysWOW64\asferror\fontdrvhost.exe
      "C:\Windows\SysWOW64\asferror\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      PID:4376
  - - C:\Windows\SysWOW64\asferror\fontdrvhost.exe
      "C:\Windows\SysWOW64\asferror\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      PID:5092
  - - C:\Windows\SysWOW64\asferror\fontdrvhost.exe
      "C:\Windows\SysWOW64\asferror\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\dui70\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\wuapi\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\d3dxof\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\asferror\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6124089b7b0428e2a09768821072b465" /sc ONLOGON /tr "'C:\Users\Default User\6124089b7b0428e2a09768821072b465.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6124089b7b0428e2a09768821072b465.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6124089b7b0428e2a09768821072b465.exe.log
Size 1KB
SHA256 c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
MD5 17573558c4e714f606f997e5157afaac
SHA1 13e16e9415ceef429aaf124139671ebeca09ed23
SHA512 f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
MD5 SHA1 SHA512

Submit Download

fontdrvhost.exe

Path C:\Windows\SysWOW64\asferror\fontdrvhost.exe
Size 1.8MB
SHA256 0aef5662a024b8b650075f4bae95edbbcb7b1e3e3986cb82bd1cc0a0a7fa86cb
MD5 e97aec688bf914dec389f404db087290
SHA1 a8c8873d36d4e0e45ca58a5bbf56ba1ee32ac907
SHA512 d7f0146decf5c64326efa1c46c6b8e78582461355d1648587ab73d361acecee43e9cc699831b9b2545bd6c6b0d4c8eb01f9c779b994283e9e1d159007be96013
SSDEEP 49152:YsY5OcNp20ou2r4HeXZspkNgtwVziGyeHanhcHoj:RY5T1x6ZseNkwZiGInhRj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontdrvhost.exe

Path C:\Windows\SysWOW64\asferror\fontdrvhost.exe
Size 2.0MB
SHA256 da1882cb18018f29cc929dc11712914db85f102bccc49ec4a1fe38d6c456865d
MD5 6124089b7b0428e2a09768821072b465
SHA1 6b854419f158d327694bd3e44030e161b622f278
SHA512 a7c4e20b3ba80cfc9ee51afa0547ba39564d69a711e116f20c0954527b7c0a12764568b5b65fd0aafc08bf57f02af00e67966431e2b79d51d68897b71302e137
SSDEEP 49152:YsY5OcNp20ou2r4HeXZspkNgtwVziGyeHanhcHoGzRg:RY5T1x6ZseNkwZiGInhRyRg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2300-60-0x0000000005360000-0x0000000005370000-memory.dmp

Download

memory/2300-59-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/2300-57-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/2388-58-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/2388-49-0x0000000005680000-0x0000000005690000-memory.dmp

Download

memory/2388-48-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/2388-47-0x0000000005680000-0x0000000005690000-memory.dmp

Download

memory/2388-46-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/3472-14-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/3472-17-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/3472-45-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/3472-22-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Download

memory/3472-19-0x0000000005850000-0x0000000005860000-memory.dmp

Download

memory/4796-10-0x0000000005070000-0x0000000005080000-memory.dmp

Download

memory/4796-8-0x0000000008D20000-0x0000000008D3A000-memory.dmp

Download

memory/4796-11-0x0000000008FF0000-0x000000000916A000-memory.dmp

Download

memory/4796-0-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/4796-12-0x00000000095D0000-0x000000000974C000-memory.dmp

Download

memory/4796-9-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/4796-13-0x0000000000C50000-0x0000000000DB4000-memory.dmp

Download

memory/4796-18-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/4796-7-0x00000000051D0000-0x0000000005226000-memory.dmp

Download

memory/4796-6-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

Download

memory/4796-5-0x0000000005070000-0x0000000005080000-memory.dmp

Download

memory/4796-4-0x0000000004FD0000-0x0000000005062000-memory.dmp

Download

memory/4796-3-0x0000000005630000-0x0000000005BD4000-memory.dmp

Download

memory/4796-2-0x0000000004E90000-0x0000000004F2C000-memory.dmp

Download

memory/4796-1-0x0000000000300000-0x000000000050A000-memory.dmp

Download