dcrat | e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6

General

Target

e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6.exe
Size

1.1MB
MD5

aeee28f5cccb12c0baffe8364f4ef4e8
SHA1

78fd4b83385c715f99365a5e0466f2223a4d6c0e
SHA256

e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6
SHA512

d3dbfdd3cb4ed9d7efca9b8f55061169dec99c05dd2605e36cf5e7d5350a2b41de37647f9fb6226574971723c819eff80829dead87fcce71f631ec35dbc2abde
SSDEEP

24576:U2G/nvxW3Ww0torEh1W5f2qBEADinMGbndR1bADL:UbA30QEXWrBEo4AX

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	3636	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	3636	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000023238-10.dat	dcrat
behavioral2/memory/2804-12-0x0000000000F80000-0x0000000001056000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	RefPerf.exe

Executes dropped EXE 2 IoCs

pid	Process
2804	RefPerf.exe
744	spoolsv.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe	RefPerf.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\f3b6ecef712a24	RefPerf.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\PrintDialog\en-US\upfc.exe	RefPerf.exe
File created	C:\Windows\Offline Web Pages\dllhost.exe	RefPerf.exe
File created	C:\Windows\Offline Web Pages\5940a34987c991	RefPerf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1356	schtasks.exe
2680	schtasks.exe
3084	schtasks.exe
2732	schtasks.exe
1196	schtasks.exe
968	schtasks.exe
5040	schtasks.exe
4704	schtasks.exe
2236	schtasks.exe
5096	schtasks.exe
3916	schtasks.exe
4036	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	RefPerf.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2804	RefPerf.exe
2804	RefPerf.exe
2804	RefPerf.exe
744	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	RefPerf.exe
Token: SeDebugPrivilege	744	spoolsv.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3276	1152	e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6.exe	85
PID 1152 wrote to memory of 3276	1152	e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6.exe	85
PID 1152 wrote to memory of 3276	1152	e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6.exe	85
PID 3276 wrote to memory of 2996	3276	WScript.exe	86
PID 3276 wrote to memory of 2996	3276	WScript.exe	86
PID 3276 wrote to memory of 2996	3276	WScript.exe	86
PID 2996 wrote to memory of 2804	2996	cmd.exe	88
PID 2996 wrote to memory of 2804	2996	cmd.exe	88
PID 2804 wrote to memory of 1288	2804	RefPerf.exe	102
PID 2804 wrote to memory of 1288	2804	RefPerf.exe	102
PID 1288 wrote to memory of 448	1288	cmd.exe	104
PID 1288 wrote to memory of 448	1288	cmd.exe	104
PID 1288 wrote to memory of 744	1288	cmd.exe	109
PID 1288 wrote to memory of 744	1288	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6.exe
"C:\Users\Admin\AppData\Local\Temp\e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\bridgeAgentfontcrt\s0XMUjAK41RpNiJ6U.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\bridgeAgentfontcrt\InKRj4szlYdZ2uThb4zCJjSF9.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\bridgeAgentfontcrt\RefPerf.exe
      "C:\bridgeAgentfontcrt\RefPerf.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1f43gTtQUl.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1288
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:448
      - C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe
        
        "C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\bridgeAgentfontcrt\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\bridgeAgentfontcrt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\bridgeAgentfontcrt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1f43gTtQUl.bat

Filesize
222B

MD5
d01bce42928c6e34680a8a1a0e647ed8

SHA1
8a47e0d2323bcbccba42e45f24edcc2cc32d2f72

SHA256
77b5363011a4f9d5fe154cb8511d7ffa93e0cef9d3d986d5b646d57c30770891

SHA512
d62fb5d7c69512b2b26508a65bc86e67cba60f4a34b9c259c1f6590d9d03b100a53f100f6df0b0dc19c2fa962f302ca11063f96764c9b4599b0af23eb80a755f

Download Submit
C:\bridgeAgentfontcrt\InKRj4szlYdZ2uThb4zCJjSF9.bat

Filesize
35B

MD5
e3999627b8bf467571542854b1ecd409

SHA1
09fbd8050ff0d635c2d64aa1f6d6279419407b72

SHA256
014aab0584ac828de2644a514742760d9506c6b62caabae7b8ec8a1c4ee22b39

SHA512
5cf0b2cda3f6521523c15dd4bb343526b844d923db46d2d385387f5387ddeed88367efb3deb2b322b847be4235b5658f8c0a129e933b849a35d46f02a142e1c7

Download Submit
C:\bridgeAgentfontcrt\RefPerf.exe

Filesize
828KB

MD5
53b6d311de2f96c5439a175203e93185

SHA1
414089dc5a8144fcd7e998908e9ffc5963dde376

SHA256
8b925bde228f5865b099429a6aea7d8191de00538a01dc153e4de92c2fa266ae

SHA512
8b32c041d7089ac0423089970da2e8b0b8e677ffa9d1f9e74abc8b0ab19f21950fa5a58f109d9323e495f8305a2958583eb6dfeb7ede7b35712480716126742a

Download Submit
C:\bridgeAgentfontcrt\s0XMUjAK41RpNiJ6U.vbe

Filesize
220B

MD5
045f8ad7d4d32dfdf1833fc4c312aa11

SHA1
e4fa08179322dc64c90e11854001179d5b357b78

SHA256
11e769525c182658dd75b22c0c1e0443f9ef22d70ef1b8fffc855c864d937c8c

SHA512
ffc3f56d9e079344d97953c840f37f3deaa6b5d8a88d775f8ecbe4e9743ad8ab7301fd9b04b8c8d4d6ffb54c512bc69a4047425d8ae4a5bfa6328ad209723701

Download Submit
memory/744-34-0x000000001B990000-0x000000001B9A0000-memory.dmp

Filesize
64KB

Download
memory/744-33-0x00007FFB6A740000-0x00007FFB6B201000-memory.dmp

Filesize
10.8MB

Download
memory/744-36-0x00007FFB6A740000-0x00007FFB6B201000-memory.dmp

Filesize
10.8MB

Download
memory/2804-12-0x0000000000F80000-0x0000000001056000-memory.dmp

Filesize
856KB

Download
memory/2804-13-0x00007FFB6AA90000-0x00007FFB6B551000-memory.dmp

Filesize
10.8MB

Download
memory/2804-14-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2804-28-0x00007FFB6AA90000-0x00007FFB6B551000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads