dcrat | 0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe
Size 1.9MB
Sample240212-cryejshg98
SHA256 0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc
MD5 03fd9c7c9d838f3e7d4a2e42c317b6be
SHA1 66976024383f4557cd20089d9621c63cbe69ef1f
SHA512 177a7f955a5060e96279262cf2fc6a34a59535c93412b1afc8f6c51c7adad1548906d25413f6b43e944154816aba98964da203f42f71192c2ef8eaaac6c40654
SSDEEP 49152:tbA3D8ThjyY3Bh5m7Uqbs3Ed/v1/hTTBxjkndCV/WY:tbpThjyY3soqbsUX1/t3jknYV/F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\csrss.exe\""	fontreviewHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\de-DE\\winlogon.exe\""	fontreviewHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\""	fontreviewHost.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	1808	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	1808	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	1808	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	1808	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	1808	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	1808	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	1808	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	1808	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	1808	schtasks.exe	88

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000023212-14.dat	dcrat
behavioral2/memory/2432-17-0x0000000000140000-0x0000000000292000-memory.dmp	dcrat
behavioral2/files/0x0006000000023217-42.dat	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	fontreviewHost.exe

Executes dropped EXE 2 IoCs

pid	Process
2432	fontreviewHost.exe
8	csrss.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	fontreviewHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	fontreviewHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	fontreviewHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	fontreviewHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Common Files\\System\\de-DE\\winlogon.exe\""	fontreviewHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Common Files\\System\\de-DE\\winlogon.exe\""	fontreviewHost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\System\de-DE\winlogon.exe	fontreviewHost.exe
File created	C:\Program Files (x86)\Common Files\System\de-DE\cc11b995f2a76d	fontreviewHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4056	schtasks.exe
1036	schtasks.exe
2328	schtasks.exe
1164	schtasks.exe
2908	schtasks.exe
3852	schtasks.exe
444	schtasks.exe
564	schtasks.exe
4980	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	fontreviewHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	fontreviewHost.exe
8	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	fontreviewHost.exe
Token: SeDebugPrivilege	8	csrss.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 3908	1828	0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe	83
PID 1828 wrote to memory of 3908	1828	0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe	83
PID 1828 wrote to memory of 3908	1828	0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe	83
PID 1828 wrote to memory of 2324	1828	0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe	84
PID 1828 wrote to memory of 2324	1828	0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe	84
PID 1828 wrote to memory of 2324	1828	0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe	84
PID 3908 wrote to memory of 4988	3908	WScript.exe	90
PID 3908 wrote to memory of 4988	3908	WScript.exe	90
PID 3908 wrote to memory of 4988	3908	WScript.exe	90
PID 4988 wrote to memory of 2432	4988	cmd.exe	91
PID 4988 wrote to memory of 2432	4988	cmd.exe	91
PID 2432 wrote to memory of 3380	2432	fontreviewHost.exe	96
PID 2432 wrote to memory of 3380	2432	fontreviewHost.exe	96
PID 3380 wrote to memory of 3152	3380	cmd.exe	95
PID 3380 wrote to memory of 3152	3380	cmd.exe	95
PID 3380 wrote to memory of 8	3380	cmd.exe	107
PID 3380 wrote to memory of 8	3380	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe
"C:\Users\Admin\AppData\Local\Temp\0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\msref\16OqJ.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\msref\WEr8EqInsZG3PEmvxO6Zoo.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\msref\fontreviewHost.exe
      "C:\msref\fontreviewHost.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\53WJ3inbs3.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3380
      - C:\odt\csrss.exe
        
        "C:\odt\csrss.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:8
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\msref\file.vbs"
  2⤵
  PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\System\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\System\de-DE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53WJ3inbs3.bat

Path C:\Users\Admin\AppData\Local\Temp\53WJ3inbs3.bat
Size 181B
SHA256 c4d1096d3ac7a707437a35f04fb5ae9aac16c0b0b2ed2366b0d7d47c0fd77567
MD5 83c1944772fac93a216a9275dc8369bd
SHA1 5aae2d52d8b4dabe70c56373a3d4522be81a6941
SHA512 f79570af7678b236a0f91f915f8ebda4e9ce0ff38ae03979986c591c94eb2b925170e34af3c26f016369422b8e5f2ceac1733cd374ce13d2239ca59a1c681916
MD5 SHA1 SHA512

Submit Download

16OqJ.vbe

Path C:\msref\16OqJ.vbe
Size 204B
SHA256 ed50861fa5d1a5e52d9e91917a03a1c0eca8d2c08231ff778b8c8540d3b5dcd8
MD5 8dc56faa119fd7cb2d6ebb11760b11aa
SHA1 514a9097a27efe40016589701e155ccf5778de01
SHA512 927b73c0cb41eb3ed8289bde8296071e59011c41440c8fd6e46e7b26a125a226fe31effe856235e294d0439d4821c48272d58bf1e8e7c2eab6ba03cb1893c9f0
MD5 SHA1 SHA512

Submit Download

WEr8EqInsZG3PEmvxO6Zoo.bat

Path C:\msref\WEr8EqInsZG3PEmvxO6Zoo.bat
Size 29B
SHA256 a0619904fb8be5d1380941ad83d000b23bd223fe0f9c6a75d166056ec2f5ac84
MD5 83e5b7bb2a52763b9c5d656d5553179e
SHA1 f0588a7031ac500b4fc4fa038cdfe8733624c1dc
SHA512 56a7b16ce444a3bbac9b0de2e929e869e4def5378ab044e66a253283adaeb6436e83e041090db73f80f905c9d40e80ddcfa432ef0ad85a1d076660b035244803
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\msref\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

fontreviewHost.exe

Path C:\msref\fontreviewHost.exe
Size 1.3MB
SHA256 12f056e68cc558dbfd426bc4bcc4d1ecb539d808caeac809431dd8a670a278f8
MD5 4db3230683f87082e1c24fac6f0a1304
SHA1 c0c259ccf54aad4732825e00c316338f872cfd7a
SHA512 8ac942967c35de5a42bedba0e609e68e5af8eee10ea9ef85c1d263ced082bdad34f6ace04f3f4b4401c351f9bfbb1a55338f871013bb22f5b5afaffe4aa5ab74
SSDEEP 24576:6N5rMOQb7Unqb7AAyjEaWiWkYJ0q1/hy8bHBYy44OiSQVGkkdr+JPrJHlU7wZ:u5m7Uqbs3Ed/v1/hTTBxjkndCV/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\odt\csrss.exe
Size 1.2MB
SHA256 b533e77076a47aa4af7d9a50e72b3b86c76e05aa01a4d6b0dfcb2b9d92f37a71
MD5 53ab5fc1f5ef9157b2c44ae316ab51c5
SHA1 b22ea1ecd4542df017fd67dbb085caeeb40043e1
SHA512 1d05afb16182b266fa9e0c03b9110a1910327366dab63f839e55f6fcf89809b4c10db59196a8aaca17dc4cb437bc633bbf2b5c6abacd4fd1332e75d7a45347e9
SSDEEP 24576:6N5rMOQb7Unqb7AAyjEaWiWkYJ0q1/hy8bHBYy44OiSQVGkkdr+JY:u5m7Uqbs3Ed/v1/hTTBxjkndCm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-46-0x00007FF8CA020000-0x00007FF8CAAE1000-memory.dmp

Download

memory/8-44-0x000000001CA40000-0x000000001CA52000-memory.dmp

Download

memory/8-43-0x00007FF8CA020000-0x00007FF8CAAE1000-memory.dmp

Download

memory/2432-25-0x000000001B420000-0x000000001B42E000-memory.dmp

Download

memory/2432-26-0x000000001B430000-0x000000001B438000-memory.dmp

Download

memory/2432-39-0x00007FF8CA180000-0x00007FF8CAC41000-memory.dmp

Download

memory/2432-22-0x000000001AE70000-0x000000001AE86000-memory.dmp

Download

memory/2432-24-0x000000001BB00000-0x000000001C028000-memory.dmp

Download

memory/2432-21-0x000000001B470000-0x000000001B4C0000-memory.dmp

Download

memory/2432-20-0x0000000002370000-0x000000000238C000-memory.dmp

Download

memory/2432-23-0x000000001AE90000-0x000000001AEA2000-memory.dmp

Download

memory/2432-19-0x000000001B010000-0x000000001B020000-memory.dmp

Download

memory/2432-18-0x00007FF8CA180000-0x00007FF8CAC41000-memory.dmp

Download

memory/2432-17-0x0000000000140000-0x0000000000292000-memory.dmp

Download