dcrat | af00e3c4645fac761a47656f84d5c2036307f00bb01a6fc5be008e5839e4a010

General

Target

fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
Size

1.2MB
MD5

fd4a3af3861edfa99ca15c7b6dff39b2
SHA1

00cd93349f4ab8a3b5896440e31dc899cd8585b6
SHA256

af00e3c4645fac761a47656f84d5c2036307f00bb01a6fc5be008e5839e4a010
SHA512

8e447c4c017f3573b7c13b01fa6f2bebcc24ebf7b1ca859fc216b16003b0feec95b21a45906c0d6d180a312a73a9b8c4b0cf9c7db336f3ba8d449a39ba09be4b
SSDEEP

12288:BgHD+WWwXwSqYkjyPnV8GH2Yhpgqx+5R9BIPkMj3lH4cLRCUwphVlEAJqn4:BM+WnHMjyPV8o2Yv+YL31/LCtJ+4

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2012	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2012	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2012	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2012	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2012	schtasks.exe	28

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2004-0-0x0000000000A20000-0x0000000000B4E000-memory.dmp	dcrat
behavioral1/files/0x0006000000015d20-11.dat	dcrat
behavioral1/memory/2452-21-0x0000000000D20000-0x0000000000E4E000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2452	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\PerfLogs\\Admin\\audiodg.exe\""	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Internet Explorer\\taskhost.exe\""	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log\\fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe\""	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\rasppp\\sppsvc.exe\""	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\ReAgent\\sppsvc.exe\""	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\rasppp\sppsvc.exe	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
File created	C:\Windows\System32\rasppp\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
File created	C:\Windows\System32\ReAgent\sppsvc.exe	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
File created	C:\Windows\System32\ReAgent\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\taskhost.exe	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\b75386f1303e64d8139363b71e44ac16341adf4e	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2504	schtasks.exe
2636	schtasks.exe
2408	schtasks.exe
2616	schtasks.exe
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
2452	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
Token: SeDebugPrivilege	2452	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2536	2004	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2536	2004	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2536	2004	fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe	34
PID 2536 wrote to memory of 2404	2536	cmd.exe	36
PID 2536 wrote to memory of 2404	2536	cmd.exe	36
PID 2536 wrote to memory of 2404	2536	cmd.exe	36
PID 2536 wrote to memory of 2416	2536	cmd.exe	37
PID 2536 wrote to memory of 2416	2536	cmd.exe	37
PID 2536 wrote to memory of 2416	2536	cmd.exe	37
PID 2536 wrote to memory of 2452	2536	cmd.exe	38
PID 2536 wrote to memory of 2452	2536	cmd.exe	38
PID 2536 wrote to memory of 2452	2536	cmd.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bpyqDBhT02.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2404
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log\fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log\fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\PerfLogs\Admin\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log\fd4a3af3861edfa99ca15c7b6dff39b2_JaffaCakes118.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\rasppp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\ReAgent\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bpyqDBhT02.bat

Filesize
356B

MD5
0162395db43abc019f6d2ea6007dc72c

SHA1
aef57d78d6a843ed299cf5df5ab9e6b52a6f06b5

SHA256
c1a469bd3be92bae01429309504ba0563949b8df3c40b2713d90e69f1232c1d1

SHA512
9576b64ce122a59b2810a4bd596a0df715064cf79ee87e08f5a8252b7ac8de144f677c83a518ead4ae1acc454ec68db5586a491eb6242e65f017da96b5e41c92

Download Submit
C:\Windows\System32\ReAgent\sppsvc.exe

Filesize
1.2MB

MD5
fd4a3af3861edfa99ca15c7b6dff39b2

SHA1
00cd93349f4ab8a3b5896440e31dc899cd8585b6

SHA256
af00e3c4645fac761a47656f84d5c2036307f00bb01a6fc5be008e5839e4a010

SHA512
8e447c4c017f3573b7c13b01fa6f2bebcc24ebf7b1ca859fc216b16003b0feec95b21a45906c0d6d180a312a73a9b8c4b0cf9c7db336f3ba8d449a39ba09be4b

Download Submit
memory/2004-0-0x0000000000A20000-0x0000000000B4E000-memory.dmp

Filesize
1.2MB

Download
memory/2004-1-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

Filesize
9.9MB

Download
memory/2004-2-0x000000001AFE0000-0x000000001B060000-memory.dmp

Filesize
512KB

Download
memory/2004-18-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

Filesize
9.9MB

Download
memory/2452-21-0x0000000000D20000-0x0000000000E4E000-memory.dmp

Filesize
1.2MB

Download
memory/2452-22-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download
memory/2452-23-0x0000000000C10000-0x0000000000C90000-memory.dmp

Filesize
512KB

Download
memory/2452-24-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads