dcrat | d297f9df259ef55fa220e34eab0a5dfdfad7909775a7b04c09f3292627abf808

Analysis

max time kernel
117s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3A320C1C60A4C3F1B21F44A6DFD1EF7C.exe
Size 1.1MB
Sample240405-dsf3bsag8v
SHA256 d297f9df259ef55fa220e34eab0a5dfdfad7909775a7b04c09f3292627abf808
MD5 3a320c1c60a4c3f1b21f44a6dfd1ef7c
SHA1 8a20f0ecb013e2ae2988e3b085c96292e23d8f64
SHA512 8470d0f8bb3e7f8c9c96cbf0f9a251b671da1ffafb8fc3ab6c4f3e5926276733b04dcb545686480419cc0d24fe433d9b5a1f672c8afc1aa1e47a5a3803edfb97
SSDEEP 24576:U2G/nvxW3Ww0tDxOh02EkLY5sQqAjQZBnRi:UbA30PaQSo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	3500	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	3500	schtasks.exe	92

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000231ee-9.dat	dcrat
behavioral2/memory/4988-12-0x0000000000780000-0x0000000000856000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	surrogateRef.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	3A320C1C60A4C3F1B21F44A6DFD1EF7C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
4988	surrogateRef.exe
1548	Registry.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Registry.exe	surrogateRef.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\ee2ad38f3d4382	surrogateRef.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\ImmersiveControlPanel\spoolsv.exe	surrogateRef.exe
File created	C:\Windows\ImmersiveControlPanel\f3b6ecef712a24	surrogateRef.exe
File created	C:\Windows\LiveKernelReports\Idle.exe	surrogateRef.exe
File opened for modification	C:\Windows\LiveKernelReports\Idle.exe	surrogateRef.exe
File created	C:\Windows\LiveKernelReports\6ccacd8608530f	surrogateRef.exe
File created	C:\Windows\es-ES\StartMenuExperienceHost.exe	surrogateRef.exe
File created	C:\Windows\es-ES\55b276f4edf653	surrogateRef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3760	schtasks.exe
856	schtasks.exe
5044	schtasks.exe
2152	schtasks.exe
2716	schtasks.exe
4892	schtasks.exe
896	schtasks.exe
388	schtasks.exe
1012	schtasks.exe
3300	schtasks.exe
1216	schtasks.exe
2784	schtasks.exe
404	schtasks.exe
1680	schtasks.exe
1552	schtasks.exe
4592	schtasks.exe
2508	schtasks.exe
1124	schtasks.exe
3168	schtasks.exe
2888	schtasks.exe
1620	schtasks.exe
4460	schtasks.exe
2300	schtasks.exe
4412	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	3A320C1C60A4C3F1B21F44A6DFD1EF7C.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4988	surrogateRef.exe
4988	surrogateRef.exe
4988	surrogateRef.exe
4988	surrogateRef.exe
4988	surrogateRef.exe
1548	Registry.exe
1548	Registry.exe
1548	Registry.exe
1548	Registry.exe
1548	Registry.exe
1548	Registry.exe
1548	Registry.exe
1548	Registry.exe
1548	Registry.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1548	Registry.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	surrogateRef.exe
Token: SeDebugPrivilege	1548	Registry.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1828	1656	3A320C1C60A4C3F1B21F44A6DFD1EF7C.exe	88
PID 1656 wrote to memory of 1828	1656	3A320C1C60A4C3F1B21F44A6DFD1EF7C.exe	88
PID 1656 wrote to memory of 1828	1656	3A320C1C60A4C3F1B21F44A6DFD1EF7C.exe	88
PID 1828 wrote to memory of 2676	1828	WScript.exe	93
PID 1828 wrote to memory of 2676	1828	WScript.exe	93
PID 1828 wrote to memory of 2676	1828	WScript.exe	93
PID 2676 wrote to memory of 4988	2676	cmd.exe	95
PID 2676 wrote to memory of 4988	2676	cmd.exe	95
PID 4988 wrote to memory of 1548	4988	surrogateRef.exe	120
PID 4988 wrote to memory of 1548	4988	surrogateRef.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3A320C1C60A4C3F1B21F44A6DFD1EF7C.exe
"C:\Users\Admin\AppData\Local\Temp\3A320C1C60A4C3F1B21F44A6DFD1EF7C.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\serverperfnet\p8SzduSpf9pu2iKB.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\serverperfnet\ceM2oCsxbXbG.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\serverperfnet\surrogateRef.exe
      "C:\serverperfnet\surrogateRef.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Registry.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Registry.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\es-ES\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\es-ES\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\serverperfnet\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\serverperfnet\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\serverperfnet\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\odt\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\ImmersiveControlPanel\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\ImmersiveControlPanel\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\odt\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ceM2oCsxbXbG.bat

Path C:\serverperfnet\ceM2oCsxbXbG.bat
Size 35B
SHA256 5ab6330ade21abaf6450dc7cd73b65125078a570386b2b101c5f4d80bdeef0c2
MD5 389aaa4be3a9d1d0e3c35889f67f9878
SHA1 b572043eaff17df7fea0986ff21749e06f300628
SHA512 7808fc942fffe1113d4f5b0cbd09b8c393724463719da47780b50c8856090c6488c3ef3dcc4da57ea510e21c9789d6f81ec3a333a40ffa49a55c93ab131e7198
MD5 SHA1 SHA512

Submit Download

p8SzduSpf9pu2iKB.vbe

Path C:\serverperfnet\p8SzduSpf9pu2iKB.vbe
Size 202B
SHA256 67ca50f26de278284bda432649307da9680b4db4ba42a7fca8015d22d2e99d42
MD5 c9ae99dab86490582150027935a2a634
SHA1 ee2921d89bda5958f3660bc24246f4b4603c053b
SHA512 5d56b5978598490c95a19a0b81ffcc105e695b662ffa7e011f6ef93982a029c34801978933dcb6695f812f2140e5e54aab8768d44809e7bbb91616b258938947
MD5 SHA1 SHA512

Submit Download

surrogateRef.exe

Path C:\serverperfnet\surrogateRef.exe
Size 827KB
SHA256 22f35d966047a62dc20a69adec57097091324dc0b2a6a433e056fb837422f626
MD5 80f06c00d25085998f27d18e82934b12
SHA1 100c370ba02bbe3b9a19554d1179b1af1c5d4fe2
SHA512 eae9457f0cc659e595e34edb9a56f0f72dbd2bce422e899a315137e6127e051904bd356a82c554d0024ced1bc1c207c9b671e4fcd888e35111a51c9c5327996f
SSDEEP 12288:R4dkdOh0oS8EkLY3psh6bG9TA1nx3ZLaZBniE:RxOh02EkLY5sQqAjQZBnR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1548-43-0x00007FFABE090000-0x00007FFABEB51000-memory.dmp

Download

memory/1548-44-0x000000001B490000-0x000000001B4A0000-memory.dmp

Download

memory/1548-45-0x00007FFABE090000-0x00007FFABEB51000-memory.dmp

Download

memory/1548-46-0x000000001B490000-0x000000001B4A0000-memory.dmp

Download

memory/4988-12-0x0000000000780000-0x0000000000856000-memory.dmp

Download

memory/4988-13-0x00007FFABE090000-0x00007FFABEB51000-memory.dmp

Download

memory/4988-14-0x0000000001040000-0x0000000001050000-memory.dmp

Download

memory/4988-42-0x00007FFABE090000-0x00007FFABEB51000-memory.dmp

Download