dcrat | 381bb149e04bec8f62336cdf3c81741c2c7a471f6dacc2f7835eb174643abad7

Analysis

max time kernel
141s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
077284acb39cb3947ed5e9c00dd81420.exe
Size 11.4MB
Sample240119-mxtcwscdhr
SHA256 381bb149e04bec8f62336cdf3c81741c2c7a471f6dacc2f7835eb174643abad7
MD5 077284acb39cb3947ed5e9c00dd81420
SHA1 280a7b8c70de63a6f58e06614c3de288756a4bbd
SHA512 e4346a8b2e9f3625650bebbb8d833b9c1a41ff83d77dac1d6bccf9a2927ef0e6adc8576ca4d73e809228bfe620320b7fad9de5650ea51f0a65edfbcf5256b17b
SSDEEP 196608:Js+LQDRpH5IdFWYjIq9Hn+4vtoU748UigNXWgVh4GuNi5oagSxijLznw:++kRMFWnUJviUrGWUhuljI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	3044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	3044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	3044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	3044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	3044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	3044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	3044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	3044	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	3044	schtasks.exe	93

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023200-4.dat	dcrat
behavioral2/memory/4804-16-0x0000000000400000-0x0000000000F69000-memory.dmp	dcrat
behavioral2/files/0x000600000002320a-27.dat	dcrat
behavioral2/files/0x000600000002320a-28.dat	dcrat
behavioral2/memory/1916-29-0x00000000007B0000-0x0000000000886000-memory.dmp	dcrat
behavioral2/files/0x0006000000023211-34.dat	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	077284acb39cb3947ed5e9c00dd81420.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	chainrefperf.exe

Executes dropped EXE 4 IoCs

pid	Process
3084	DCRatBuild.exe
3308	Wild.exe
1916	chainrefperf.exe
492	conhost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\taskhostw.exe	chainrefperf.exe
File created	C:\Program Files\Windows Portable Devices\ea9f0e6c9e2dcd	chainrefperf.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\OCR\en-us\TextInputHost.exe	chainrefperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5008	schtasks.exe
884	schtasks.exe
432	schtasks.exe
748	schtasks.exe
1592	schtasks.exe
2864	schtasks.exe
4076	schtasks.exe
4864	schtasks.exe
4652	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	DCRatBuild.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1916	chainrefperf.exe
1916	chainrefperf.exe
1916	chainrefperf.exe
492	conhost.exe
492	conhost.exe
492	conhost.exe
492	conhost.exe
492	conhost.exe
492	conhost.exe
492	conhost.exe
492	conhost.exe
492	conhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	chainrefperf.exe
Token: SeDebugPrivilege	492	conhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3084	4804	077284acb39cb3947ed5e9c00dd81420.exe	88
PID 4804 wrote to memory of 3084	4804	077284acb39cb3947ed5e9c00dd81420.exe	88
PID 4804 wrote to memory of 3084	4804	077284acb39cb3947ed5e9c00dd81420.exe	88
PID 4804 wrote to memory of 3308	4804	077284acb39cb3947ed5e9c00dd81420.exe	89
PID 4804 wrote to memory of 3308	4804	077284acb39cb3947ed5e9c00dd81420.exe	89
PID 3084 wrote to memory of 3684	3084	DCRatBuild.exe	90
PID 3084 wrote to memory of 3684	3084	DCRatBuild.exe	90
PID 3084 wrote to memory of 3684	3084	DCRatBuild.exe	90
PID 3684 wrote to memory of 4992	3684	WScript.exe	92
PID 3684 wrote to memory of 4992	3684	WScript.exe	92
PID 3684 wrote to memory of 4992	3684	WScript.exe	92
PID 4992 wrote to memory of 1916	4992	cmd.exe	95
PID 4992 wrote to memory of 1916	4992	cmd.exe	95
PID 1916 wrote to memory of 492	1916	chainrefperf.exe	108
PID 1916 wrote to memory of 492	1916	chainrefperf.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\077284acb39cb3947ed5e9c00dd81420.exe
"C:\Users\Admin\AppData\Local\Temp\077284acb39cb3947ed5e9c00dd81420.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\PortcontainerDriverhostCrt\Dz6wy.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\PortcontainerDriverhostCrt\hCld9MmfusAwi.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\PortcontainerDriverhostCrt\chainrefperf.exe
        
        "C:\PortcontainerDriverhostCrt\chainrefperf.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1916
      - C:\Recovery\WindowsRE\conhost.exe
        
        "C:\Recovery\WindowsRE\conhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:492
- C:\Users\Admin\AppData\Local\Temp\Wild.exe
  "C:\Users\Admin\AppData\Local\Temp\Wild.exe"
  2⤵
  - Executes dropped EXE
  PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dz6wy.vbe

Path C:\PortcontainerDriverhostCrt\Dz6wy.vbe
Size 216B
SHA256 dc2fa956265f7dec0e6b7c4a693b754309561a26c253b0cfb33eec1a41ad10d7
MD5 08343f3b6837d66d4cab474332b8eb41
SHA1 00a9570d698de585764de16f4148fb6745bcd68a
SHA512 bcc577581ee4b65fd43656c1e3d85750b7a65d9425e3a56b766062602d78f0a56c5d60311ce2be120fbb51d0da2aa56434141eda466ecc6c18ff0e02cc5b9d32
MD5 SHA1 SHA512

Submit Download

chainrefperf.exe

Path C:\PortcontainerDriverhostCrt\chainrefperf.exe
Size 128KB
SHA256 975bbe6fa966474032ec3a2bce6b1c7ab99d6c6cae48cafa3f23929853694c6b
MD5 20af3a270c168dcbd743d8f3de9b7f03
SHA1 3bf62f72714ebee74a4ceed5650f80812686e369
SHA512 2151c83b9271b5ea76ecdcf0f7d42933ee4473ff27a3c56e0855bd338ab331214d08ed9f975f5f35132701903ad49ec1c35f45215d9409ca929df82a1bddbfa7
SSDEEP 1536:BVL5Lem1bq6cLriKSh5JNZqgYVJGOTWUMVj73fw8A4oKo/Cpzr:Bp5Lel3FSHNZpYVJGOTW35AAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

chainrefperf.exe

Path C:\PortcontainerDriverhostCrt\chainrefperf.exe
Size 448KB
SHA256 fd3ecbb47aae0f9676733eef5c8d7eeb8dc5143c810a3c0483060f020b80aaae
MD5 8a3f84896f74ca6b942006df305e7244
SHA1 fa193b1c030c03bfd3c063cc627d4c1b3b04820e
SHA512 0514cd00f69ee879640e1082e58b5c0b275b6a1c146ec1f9aec9b5d496bcf203b2a9cc5171e77de302c8daa2fd8ad6319fc0e575a8d796736c4784339de2764c
SSDEEP 6144:Es/HbZTKVPjPJN9i+hfyvjoMz6OP9g3pZkOqS:J7SLJN9i+RyvjpznP9oOtS
MD5 SHA1 SHA512 SSDEEP

Submit Download

hCld9MmfusAwi.bat

Path C:\PortcontainerDriverhostCrt\hCld9MmfusAwi.bat
Size 48B
SHA256 e261c5d417c068ee968c20a605a3d1cab8ccff43ad439d0f15500d47ed925e5a
MD5 56ea5aa4d1f079f480d5fb4127e4ddc0
SHA1 7919dc836d395be7360a0c3bc0bd4d65e20b8eab
SHA512 af3e1a74344dcd034a661a6b87c545e7492937e61d03651db5ed050548e319421adab6bdba43da378bfbd177d923b7792c17e3d59012450e3d05b43f3597ce64
MD5 SHA1 SHA512

Submit Download

DCRatBuild.exe

Path C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
Size 1.1MB
SHA256 d567ea917beca31f3e7d892c9cedee685ebd968540028435ec8bf531041a1c80
MD5 8915eb1346d27097485c2c60c36e87f2
SHA1 de54669627df73e811de9edaf3de4e8e8fea57eb
SHA512 09ce8c22cc9f0aa554d56d69b74678d670be2764f59f4cfb7bee6a734e27d71cd51101b880579bdc43e50a8c969c4f3b4d25c177081c305d712e6aef899db0b5
SSDEEP 24576:U2G/nvxW3Ww0tim9NXAvjwOtNrZQxC4mpbZdtRo:UbA30jN7ONSSRi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wild.exe

Path C:\Users\Admin\AppData\Local\Temp\Wild.exe
Size 2.7MB
SHA256 f090c28f01f318b88b502895075c8c279ddc6b65eeb58031d0b462600be292e1
MD5 83ebba77f6b80853280db3557c2d4b03
SHA1 0d65f7c3778a8710f1ae5a50cf7d3e8944461162
SHA512 45a171865b29725753eecb1e8b88e234ba4ff8ac7008fed35dfc7723a16657e5d915bd624d633254976bd1f1bedb9b310bbab0bb0950f46dd73527fc55a7b682
SSDEEP 49152:Cn0uLQMxGsfuIgLcSpa8xvVeK02qH9Bcx+CQy7RO:ULQsGRIgLcSpppV02qH9uMvy9O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wild.exe

Path C:\Users\Admin\AppData\Local\Temp\Wild.exe
Size 2.5MB
SHA256 b7bf975798c033f9b2daa91029af61c068acd05a8df1cc0dd827b868362b6671
MD5 3a7fa45f30cf4f73fbc7b4131d5fd39d
SHA1 6528544811c9201956fc378957c475e3421a3848
SHA512 4ccbbd1f1a7de26f212c14e8d83f8881eca4b6cee36ceebe7ea60905549eb5932e45871d994966ea5f4a5b761d63cf70332b8fdc54b8e8b1903ad408742650c8
SSDEEP 49152:Cn0uLQMxGsfuIgLcSpa8xvVeK02qH9Bcx+CQ4:ULQsGRIgLcSpppV02qH9uMv4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wild.exe

Path C:\Users\Admin\AppData\Local\Temp\Wild.exe
Size 2.4MB
SHA256 381a5d705e53b31365e8d8bfba0954c2707b1d7382d8322e36c52796df150844
MD5 416cc56d998ad3f071e8beb2543293b4
SHA1 d8811dc42aac7e556c3ff32e6fb10e0ab73f274a
SHA512 a09cffadf2f18b03f4b57ee8a6f25ea599724164cdecbbfa7b035b02443c8d85f82ddd514c85ba017757259361a644f3963b21b9e191766af4d054b073e64265
SSDEEP 49152:Cn0uLQMxGsfuIgLcSpa8xvVeK02qH9Bcx+CQm:ULQsGRIgLcSpppV02qH9uMvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartMenuExperienceHost.exe

Path C:\odt\StartMenuExperienceHost.exe
Size 827KB
SHA256 100d36e090499f7763d7220ed81d8915f14ebc0ac69df331a8e249bed495126d
MD5 0d3adbb5c138649fe88115536d23dee9
SHA1 effdc9ba6def9527796a536d09a5b02e3fb5083d
SHA512 514560a51bb875fee0280ee2406d0e8d8816a1cbaeadd507cb7f2eefd74b802bc4f6c0a7f9f14f04fa7fa4fc505cc84ef176130aaf111b22a7957198483b1e1c
SSDEEP 12288:J7SLJN9i+RyvjpznP9oOtNrZPjETFb9OceAwhWmpbd7GWtR:Jm9NXAvjwOtNrZQxC4mpbZdtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/492-48-0x00007FFAB9650000-0x00007FFABA111000-memory.dmp

Download

memory/492-51-0x00007FFAB9650000-0x00007FFABA111000-memory.dmp

Download

memory/1916-29-0x00000000007B0000-0x0000000000886000-memory.dmp

Download

memory/1916-30-0x00007FFAB9650000-0x00007FFABA111000-memory.dmp

Download

memory/1916-31-0x000000001B470000-0x000000001B480000-memory.dmp

Download

memory/1916-50-0x00007FFAB9650000-0x00007FFABA111000-memory.dmp

Download

memory/4804-16-0x0000000000400000-0x0000000000F69000-memory.dmp

Download