dcrat | a98048f4eb2ddc489710b341ea3ef30405a13ad29b31c67e8e7e7d196edbec71

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
17/01/2024, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63db5c1f85150216bbf798f44e0327d9.exe
Size 1.1MB
Sample240117-27bcdshaa6
SHA256 a98048f4eb2ddc489710b341ea3ef30405a13ad29b31c67e8e7e7d196edbec71
MD5 63db5c1f85150216bbf798f44e0327d9
SHA1 3c074c09bc44a5f60a58c4086e30dd5978dadafb
SHA512 bc46079ff614ee29bd432d23d07ac1ddee46059b089cf92085d144f21c4e96c4b46b9d59a97c9c6d310ace3838a590d1b2c17d5ea9c4cbbd03070b9a4554c470
SSDEEP 12288:ydR0x9kljxfc+/tdu6Rp3IKF22IpWLsrgryY69C0HVq8jtjMbdoEitkhiDtqn4:Adl5c+b4Kc2I2ol9fVqajMbktaQt+4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	540	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	540	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	540	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	540	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	540	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	540	schtasks.exe	91

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2864-0-0x0000000000090000-0x00000000001A8000-memory.dmp	dcrat
behavioral2/files/0x00060000000231cc-11.dat	dcrat
behavioral2/files/0x00080000000231b9-23.dat	dcrat
behavioral2/files/0x00080000000231b9-24.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	63db5c1f85150216bbf798f44e0327d9.exe

Executes dropped EXE 1 IoCs

pid	Process
2012	dllhost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\WindowsShell\\explorer.exe\""	63db5c1f85150216bbf798f44e0327d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\Dism\\ja-JP\\RuntimeBroker.exe\""	63db5c1f85150216bbf798f44e0327d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\credprovslegacy\\taskhostw.exe\""	63db5c1f85150216bbf798f44e0327d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\mpeval\\dllhost.exe\""	63db5c1f85150216bbf798f44e0327d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	63db5c1f85150216bbf798f44e0327d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default\\Local Settings\\sihost.exe\""	63db5c1f85150216bbf798f44e0327d9.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\credprovslegacy\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	63db5c1f85150216bbf798f44e0327d9.exe
File created	C:\Windows\System32\mpeval\dllhost.exe	63db5c1f85150216bbf798f44e0327d9.exe
File created	C:\Windows\System32\mpeval\5940a34987c99120d96dace90a3f93f329dcad63	63db5c1f85150216bbf798f44e0327d9.exe
File created	C:\Windows\System32\Dism\ja-JP\RuntimeBroker.exe	63db5c1f85150216bbf798f44e0327d9.exe
File opened for modification	C:\Windows\System32\Dism\ja-JP\RuntimeBroker.exe	63db5c1f85150216bbf798f44e0327d9.exe
File created	C:\Windows\System32\Dism\ja-JP\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	63db5c1f85150216bbf798f44e0327d9.exe
File created	C:\Windows\System32\credprovslegacy\taskhostw.exe	63db5c1f85150216bbf798f44e0327d9.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\WindowsShell\explorer.exe	63db5c1f85150216bbf798f44e0327d9.exe
File created	C:\Windows\WindowsShell\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	63db5c1f85150216bbf798f44e0327d9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2196	schtasks.exe
1728	schtasks.exe
376	schtasks.exe
400	schtasks.exe
864	schtasks.exe
4424	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings	63db5c1f85150216bbf798f44e0327d9.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2864	63db5c1f85150216bbf798f44e0327d9.exe
2864	63db5c1f85150216bbf798f44e0327d9.exe
2864	63db5c1f85150216bbf798f44e0327d9.exe
2864	63db5c1f85150216bbf798f44e0327d9.exe
2864	63db5c1f85150216bbf798f44e0327d9.exe
2012	dllhost.exe
2012	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	63db5c1f85150216bbf798f44e0327d9.exe
Token: SeDebugPrivilege	2012	dllhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 744	2864	63db5c1f85150216bbf798f44e0327d9.exe	99
PID 2864 wrote to memory of 744	2864	63db5c1f85150216bbf798f44e0327d9.exe	99
PID 744 wrote to memory of 1608	744	cmd.exe	97
PID 744 wrote to memory of 1608	744	cmd.exe	97
PID 744 wrote to memory of 4440	744	cmd.exe	96
PID 744 wrote to memory of 4440	744	cmd.exe	96
PID 744 wrote to memory of 2012	744	cmd.exe	108
PID 744 wrote to memory of 2012	744	cmd.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\63db5c1f85150216bbf798f44e0327d9.exe
"C:\Users\Admin\AppData\Local\Temp\63db5c1f85150216bbf798f44e0327d9.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Asn7qFJxyP.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\System32\mpeval\dllhost.exe
    "C:\Windows\System32\mpeval\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\Dism\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\credprovslegacy\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\mpeval\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4440

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\WindowsShell\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Asn7qFJxyP.bat

Path C:\Users\Admin\AppData\Local\Temp\Asn7qFJxyP.bat
Size 254B
SHA256 2ad6659d04ef2bb40ac09785981ec5f1618565de00244ae61c0c21d782a7be56
MD5 d3e59b6df393b118114be1678b937598
SHA1 22baebc50ea336e965f6866986e3e243067ea958
SHA512 f0bcc2e63610cf58085f7e0ec67e4717a57cc650f0a7c520afe6dbc0d96085cd7ebeb806e4b2869e08d6502cc4def6bb3cb5de301e6c611cb8dd1b02c910785b
MD5 SHA1 SHA512

Submit Download

sihost.exe

Path C:\Users\Default\AppData\Local\sihost.exe
Size 1.1MB
SHA256 a98048f4eb2ddc489710b341ea3ef30405a13ad29b31c67e8e7e7d196edbec71
MD5 63db5c1f85150216bbf798f44e0327d9
SHA1 3c074c09bc44a5f60a58c4086e30dd5978dadafb
SHA512 bc46079ff614ee29bd432d23d07ac1ddee46059b089cf92085d144f21c4e96c4b46b9d59a97c9c6d310ace3838a590d1b2c17d5ea9c4cbbd03070b9a4554c470
SSDEEP 12288:ydR0x9kljxfc+/tdu6Rp3IKF22IpWLsrgryY69C0HVq8jtjMbdoEitkhiDtqn4:Adl5c+b4Kc2I2ol9fVqajMbktaQt+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path C:\Windows\System32\mpeval\dllhost.exe
Size 1024KB
SHA256 fea1717e16aebce06371444c051cdc6bc9ea5bed05b5433204ac65390cd2e905
MD5 0bfe0df142bfc78bd566a9480527d783
SHA1 4bb61b6bc2d270b29e4133398e2870270c393027
SHA512 879d5735739a6995639d0bd1746e6c32f58e0fe2c799307bdf86488a0140315fa2de03056cd07d9ecfa3662ac599800cff6ac4d0dc1c41cfbfa5df6d2925b2b0
SSDEEP 12288:ydR0x9kljxfc+/tdu6Rp3IKF22IpWLsrgryY69C0HVq8jtjMbdoEitk/:Adl5c+b4Kc2I2ol9fVqajMbkti
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path C:\Windows\System32\mpeval\dllhost.exe
Size 93KB
SHA256 b517c707cc5ad55ae051b06e5acf06229026bbb9737fdc2123b960ae1601ee5a
MD5 6be122ff50976856bef47a919c883f29
SHA1 aff1a37e594c4be793cce2ac491a82a5901f4ac8
SHA512 d481e533eacf8fc8a6d5fdafd0eb7e9ff3e921e1eb9e96f208059be957b367beff28b1c42c9644ec613e3ae1bb4cb14312f159b235b33b4fb29777820653f697
SSDEEP 1536:n123JOjt0r0JKTdnR0bdQZCBQLoN0NT+JVZLvH:125OjtS0gTdR0bd7Sx5+V7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2012-25-0x00007FF8369E0000-0x00007FF8374A1000-memory.dmp

Download

memory/2012-26-0x0000000002E30000-0x0000000002E40000-memory.dmp

Download

memory/2012-28-0x00007FF8369E0000-0x00007FF8374A1000-memory.dmp

Download

memory/2864-0-0x0000000000090000-0x00000000001A8000-memory.dmp

Download

memory/2864-1-0x00007FF836D30000-0x00007FF8377F1000-memory.dmp

Download

memory/2864-2-0x000000001AD90000-0x000000001ADA0000-memory.dmp

Download

memory/2864-21-0x00007FF836D30000-0x00007FF8377F1000-memory.dmp

Download