dcrat | 94009d1129caa3d7c53557e6f0bc10c546b70389242959cf710ec19b64d66d7a

General

Target

88d152d4ca2aad8c3aec5567cf9d6962.exe
Size

365KB
MD5

88d152d4ca2aad8c3aec5567cf9d6962
SHA1

d98c4fdccbe6e012803e889a712919c94b279b78
SHA256

94009d1129caa3d7c53557e6f0bc10c546b70389242959cf710ec19b64d66d7a
SHA512

bbf281515abe55d6b4853368dc74d030b62709976ba413b7b8d5c05105d99980eb19a2b1bf128d09c2e77c3331ad83e590a206f840a6afb9d60ec52d606102fb
SSDEEP

6144:Khg8RILtEndj8KoOnBCI9LtzN+4lPkJDuXAuY+DWRNqqDL:KpndjJIan+4lkD0Y+Vqn

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4884-0-0x0000017CA7950000-0x0000017CA79B2000-memory.dmp	dcrat
behavioral2/files/0x0006000000023121-11.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3876	88d152d4ca2aad8c3aec5567cf9d6962.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\dotnet\\swidtag\\WaaSMedicAgent.exe\""	88d152d4ca2aad8c3aec5567cf9d6962.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\odt\\SearchApp.exe\""	88d152d4ca2aad8c3aec5567cf9d6962.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Admin\\TextInputHost.exe\""	88d152d4ca2aad8c3aec5567cf9d6962.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	88d152d4ca2aad8c3aec5567cf9d6962.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\odt\\taskhostw.exe\""	88d152d4ca2aad8c3aec5567cf9d6962.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\88d152d4ca2aad8c3aec5567cf9d6962 = "\"C:\\Users\\Public\\88d152d4ca2aad8c3aec5567cf9d6962.exe\""	88d152d4ca2aad8c3aec5567cf9d6962.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\BHO\\sppsvc.exe\""	88d152d4ca2aad8c3aec5567cf9d6962.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\ProgramData\\Documents\\TextInputHost.exe\""	88d152d4ca2aad8c3aec5567cf9d6962.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\sppsvc.exe	88d152d4ca2aad8c3aec5567cf9d6962.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\sppsvc.exe	88d152d4ca2aad8c3aec5567cf9d6962.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	88d152d4ca2aad8c3aec5567cf9d6962.exe
File created	C:\Program Files\dotnet\swidtag\WaaSMedicAgent.exe	88d152d4ca2aad8c3aec5567cf9d6962.exe
File created	C:\Program Files\dotnet\swidtag\c82b8037eab33d1fe33ed5c436875fcafdbefbee	88d152d4ca2aad8c3aec5567cf9d6962.exe

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1768	schtasks.exe
512	schtasks.exe
1844	schtasks.exe
4580	schtasks.exe
2344	schtasks.exe
660	schtasks.exe
2264	schtasks.exe
4364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4884	88d152d4ca2aad8c3aec5567cf9d6962.exe
3876	88d152d4ca2aad8c3aec5567cf9d6962.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe
Token: SeDebugPrivilege	3876	88d152d4ca2aad8c3aec5567cf9d6962.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1844	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	88
PID 4884 wrote to memory of 1844	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	88
PID 4884 wrote to memory of 4580	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	90
PID 4884 wrote to memory of 4580	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	90
PID 4884 wrote to memory of 2344	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	92
PID 4884 wrote to memory of 2344	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	92
PID 4884 wrote to memory of 660	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	94
PID 4884 wrote to memory of 660	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	94
PID 4884 wrote to memory of 2264	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	96
PID 4884 wrote to memory of 2264	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	96
PID 4884 wrote to memory of 4364	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	98
PID 4884 wrote to memory of 4364	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	98
PID 4884 wrote to memory of 1768	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	100
PID 4884 wrote to memory of 1768	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	100
PID 4884 wrote to memory of 512	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	102
PID 4884 wrote to memory of 512	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	102
PID 4884 wrote to memory of 3876	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	104
PID 4884 wrote to memory of 3876	4884	88d152d4ca2aad8c3aec5567cf9d6962.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\88d152d4ca2aad8c3aec5567cf9d6962.exe
"C:\Users\Admin\AppData\Local\Temp\88d152d4ca2aad8c3aec5567cf9d6962.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\sppsvc.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1844
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\ProgramData\Documents\TextInputHost.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:4580
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\WaaSMedicAgent.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2344
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:660
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Admin\TextInputHost.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2264
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:4364
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1768
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "88d152d4ca2aad8c3aec5567cf9d6962" /sc ONLOGON /tr "'C:\Users\Public\88d152d4ca2aad8c3aec5567cf9d6962.exe'" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:512
- C:\Users\Public\88d152d4ca2aad8c3aec5567cf9d6962.exe
  "C:\Users\Public\88d152d4ca2aad8c3aec5567cf9d6962.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\88d152d4ca2aad8c3aec5567cf9d6962.exe.log

Filesize
1KB

MD5
e8d8201859f0733371b04a69e90297ae

SHA1
8222cd86cf6633bdab806efb6cd8f336e2d0187b

SHA256
7f70c61beb86a5573a1c9f37136d60aa88ab65f11bd94e5303c4e2e8d11f8f9f

SHA512
63ba5c2778f02f62a2570d35ec6eb002c94093b94098315ac991b3c70a9d14ba8f3904067cf737df32a3f2e1924b29d7f722613024c2fdb11cf63d46b1bdb627

Download Submit
C:\Users\Admin\TextInputHost.exe

Filesize
365KB

MD5
88d152d4ca2aad8c3aec5567cf9d6962

SHA1
d98c4fdccbe6e012803e889a712919c94b279b78

SHA256
94009d1129caa3d7c53557e6f0bc10c546b70389242959cf710ec19b64d66d7a

SHA512
bbf281515abe55d6b4853368dc74d030b62709976ba413b7b8d5c05105d99980eb19a2b1bf128d09c2e77c3331ad83e590a206f840a6afb9d60ec52d606102fb

Download Submit
memory/3876-25-0x00007FF977A80000-0x00007FF978541000-memory.dmp

Filesize
10.8MB

Download
memory/3876-26-0x000001F33A210000-0x000001F33A220000-memory.dmp

Filesize
64KB

Download
memory/3876-27-0x00007FF977A80000-0x00007FF978541000-memory.dmp

Filesize
10.8MB

Download
memory/4884-0-0x0000017CA7950000-0x0000017CA79B2000-memory.dmp

Filesize
392KB

Download
memory/4884-1-0x00007FF977A80000-0x00007FF978541000-memory.dmp

Filesize
10.8MB

Download
memory/4884-2-0x0000017CC1F40000-0x0000017CC1F50000-memory.dmp

Filesize
64KB

Download
memory/4884-24-0x00007FF977A80000-0x00007FF978541000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads