dcrat | 1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5

General

Target

1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
Size

1.3MB
MD5

a496655d47395c366faf63221b9b0cc4
SHA1

1abfa977804bf18315087adfac334d019221db07
SHA256

1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5
SHA512

a5a0fded68772d46217f8515daccf556abc0af37112b70d36a2552805bba480e689c6d3d72b742214e474717d0be24e3324e287402de23aa31224026e1f4b101
SSDEEP

24576:mpORKlEFLFVOvoOFniNL1nDS662lWiqqB2xT/KggOIJevr8/a0MnvBBm:CHl4pwvoOFKxY2l5qh2ggOHo/gnv7m

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 16 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2600-1-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-5-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-6-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-7-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-10-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-11-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-12-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-13-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-14-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-15-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-16-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-17-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-18-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-19-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-20-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat
behavioral1/memory/2600-21-0x0000000000060000-0x0000000000444000-memory.dmp	dcrat

Detects executables containing bas64 encoded gzip files 16 IoCs

resource	yara_rule
behavioral1/memory/2600-1-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-5-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-6-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-7-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-10-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-11-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-12-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-13-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-14-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-15-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-16-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-17-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-18-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-19-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-20-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral1/memory/2600-21-0x0000000000060000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipinfo.io
7	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2600	1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe

C:\Users\Admin\AppData\Local\Temp\1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe
"C:\Users\Admin\AppData\Local\Temp\1a3a78f874d806d86e4a781aa267d1a03ec959635011dbedbe5be2adca46b9c5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-0-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-2-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2600-1-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-3-0x0000000005900000-0x0000000005940000-memory.dmp

Filesize
256KB

Download
memory/2600-4-0x0000000002650000-0x000000000265C000-memory.dmp

Filesize
48KB

Download
memory/2600-5-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-6-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-7-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-8-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2600-9-0x0000000005900000-0x0000000005940000-memory.dmp

Filesize
256KB

Download
memory/2600-10-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-11-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-12-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-13-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-14-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-15-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-16-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-17-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-18-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-19-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-20-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download
memory/2600-21-0x0000000000060000-0x0000000000444000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing