dcrat | c826d112cbfa6ac5f2950113046c40a0aa00bc1595a0f2019d108df02b99b0a4

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe
Size 1.9MB
Sample240516-j5anzaca72
SHA256 c826d112cbfa6ac5f2950113046c40a0aa00bc1595a0f2019d108df02b99b0a4
MD5 4a2902958e01cc91f2e71736e0de83aa
SHA1 dcd0b86a807feeb0aa8e1178961b2685fb5cb502
SHA512 ba14483508d21b04f99f42f8e544af296d214569a1d0ef8bae173a6acbe84f3f5e14b6b637685b1dfd5a794b5473f7276a71d0ea039e9bdab64552b5064d3c35
SSDEEP 49152:P+NJvFDhjAe+RVZWI1oLTXD3+s5RHj7KoLl+c733H:0Ch3tmLTL+szfKoZT33H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat upx

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	AVvht7K88OJxvVRxYaye.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkpHst32.lnk	kasperskiy.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winlog.lnk	kasperskiy.exe

Executes dropped EXE 2 IoCs

pid	Process
4200	AVvht7K88OJxvVRxYaye.exe
2620	kasperskiy.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/448-0-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/448-13-0x0000000000400000-0x00000000004BE000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3dx32 = "C:\\Users\\Admin\\AppData\\Roaming\\System.lnk"	kasperskiy.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	AVvht7K88OJxvVRxYaye.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe
2620	kasperskiy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	kasperskiy.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 1404	448	4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe	83
PID 448 wrote to memory of 1404	448	4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe	83
PID 448 wrote to memory of 1404	448	4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe	83
PID 1404 wrote to memory of 1768	1404	WScript.exe	84
PID 1404 wrote to memory of 1768	1404	WScript.exe	84
PID 1404 wrote to memory of 1768	1404	WScript.exe	84
PID 1768 wrote to memory of 4200	1768	cmd.exe	86
PID 1768 wrote to memory of 4200	1768	cmd.exe	86
PID 1768 wrote to memory of 4200	1768	cmd.exe	86
PID 4200 wrote to memory of 2104	4200	AVvht7K88OJxvVRxYaye.exe	87
PID 4200 wrote to memory of 2104	4200	AVvht7K88OJxvVRxYaye.exe	87
PID 4200 wrote to memory of 2104	4200	AVvht7K88OJxvVRxYaye.exe	87
PID 2104 wrote to memory of 1584	2104	WScript.exe	93
PID 2104 wrote to memory of 1584	2104	WScript.exe	93
PID 2104 wrote to memory of 1584	2104	WScript.exe	93
PID 1584 wrote to memory of 2620	1584	cmd.exe	95
PID 1584 wrote to memory of 2620	1584	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\FM1GV0nwV6NBGMhpkFkspN3EXmNiKp.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\rDsNawCN4GJP9CexwTN1QKqyWf0dob.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe
      AVvht7K88OJxvVRxYaye.exe -p1eee374ad5fc54c69c3297f577d8316beeaaed85
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\System.vbe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2104
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\fV2k5DsZiGZrbZzOAu29ftdemcCJJ1.bat" "
        6⤵
        Drops startup file
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Users\Admin\AppData\Roaming\kasperskiy.exe
        
        "C:\Users\Admin\AppData\Roaming\kasperskiy.exe"
        7⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AVvht7K88OJxvVRxYaye.exe

Path C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe
Size 1.5MB
SHA256 06b4ab5add1e394b089c9552bc4e2ad742093af6129d927cf38206d9f9d9297d
MD5 07deb9adc1b5c6b6c0654c589b593b2a
SHA1 d636fcdece4747ea544554799e65f9d8e9ae2b41
SHA512 97249b09693073f449f6981493c9f92543085ae0033c8759d22e6aee93e049656d2cd87a53fb90b4db81ccb38dde88a26ce3f47e1c70ab164dbd509a13a245c1
SSDEEP 24576:5W6VXRhP26zyTXycWe2pAvrBDvCr4xeq0d4yhFYU5huxT6tMjuKrEklyo65+FlVR:s6ByGcWeqmrBGr4eqLykIuTrxvf/1XAu
MD5 SHA1 SHA512 SSDEEP

Submit Download

FM1GV0nwV6NBGMhpkFkspN3EXmNiKp.vbs

Path C:\Users\Admin\AppData\Roaming\FM1GV0nwV6NBGMhpkFkspN3EXmNiKp.vbs
Size 116B
SHA256 5b632746488d9fa873ac24438337bf4db9653c2bac58a5038ff81e13b460448a
MD5 5253157db7b043f538a1f416835f254c
SHA1 f83c5e3f6133b92ffe2e8f8c6c05d95efe434414
SHA512 4709a2d6829fdecdfdbb02421bcd92ec1df7c842eb0565d63bdcc121fe7c1eb11d032f62f07d4a4125b2a8412a5703084aa42c54de9ba0f12a151e4c6adf19f1
MD5 SHA1 SHA512

Submit Download

System.lnk

Path C:\Users\Admin\AppData\Roaming\System.lnk
Size 1KB
SHA256 9110629e8e63b4c39b1510a67f102af5f849693d296ff063b869ccc0c51a429d
MD5 42c77986a8b408f34c91db316226baa2
SHA1 5d84a29c78bed4615ba34153f1619199d0881065
SHA512 cd550f69793b6fe06a9a1bbe7bd652536dbcb1d3c4e468fb5b31b7e35dadbf89c36cbe745bcba4f2358a4c6b9d6e78dda9bf4fd704868f7e5ad86833a9d9a766
MD5 SHA1 SHA512

Submit Download

System.vbe

Path C:\Users\Admin\AppData\Roaming\System.vbe
Size 364B
SHA256 9fea306141dd85b2876bb7cbb2b2abfd724854f72bd27ceef82803fc8219d035
MD5 3889b1a5f010ce2cdae701aa12e12748
SHA1 888f40b996c0cf3312de3fdfff2e30b8e6576c85
SHA512 f8622c460cd50c7b33f58b711ddf442d3f9906ccd74fdaffd5deafc1340aa159b15eea2b18490243dc1779fef6bc10e8edf17f383745efe745378a82d9a760bd
MD5 SHA1 SHA512

Submit Download

fV2k5DsZiGZrbZzOAu29ftdemcCJJ1.bat

Path C:\Users\Admin\AppData\Roaming\fV2k5DsZiGZrbZzOAu29ftdemcCJJ1.bat
Size 723B
SHA256 5903cb7ab21cccf29725cac35a4db516c5d586f3a9bea52b4335f80d91b48eef
MD5 1cc1057e91edd02ce3af9a6a193b2520
SHA1 842f11d646906fe671970a51bebc645200af733b
SHA512 9e966d6de171230c7d8156a587960dedabfb46d3430155f421ee5befcf77577217c99190f74c565ba07a502bcc69e65bc6568b12700345618be2cb16ba68a73c
MD5 SHA1 SHA512

Submit Download

kasperskiy.exe

Path C:\Users\Admin\AppData\Roaming\kasperskiy.exe
Size 1.9MB
SHA256 3eedee6c55f3c66b94413397fdf4b4fda05e7706bf9ba99df1090508986180a2
MD5 ecf4b9b54c43151ea020b003e1db2fc9
SHA1 441252d8a0bb62cae18c692c3e52e876485c404b
SHA512 b79a66f95c33f2bceca6f8319130dd6f9fa6807ed11eb9139ef8e5bcc604917925fb6f8f33dfc54aae3e1c1681216be5551a266f8344a8c71846f724544c975d
SSDEEP 49152:FcXrZRJgwxHa2xiaFl4bxKxkHbj+L34/Mo:FcXrZp4uKxKxUHC34/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

rDsNawCN4GJP9CexwTN1QKqyWf0dob.bat

Path C:\Users\Admin\AppData\Roaming\rDsNawCN4GJP9CexwTN1QKqyWf0dob.bat
Size 100B
SHA256 3e280177c9acc9a20336f14086bb1fed8ce63eacf8f4aae08015538b0ee76168
MD5 a0c2c81f8c81da5f49ab2835e468a304
SHA1 9041173a0baa1a6e840f2fbc0a76ab01726292b6
SHA512 9835061782b222becd2b9128d97789844916f4ec76a987d95885733c3c9c80769f6aa3f8d74a3295e0528556d0958188df7394d6e7828371f6c4bd413aafa7ae
MD5 SHA1 SHA512

Submit Download

vmcheck32.dll

Path C:\Users\Admin\AppData\Roaming\vmcheck32.dll
Size 684B
SHA256 f07a6667289d38a1aa11e85a92c4d3de74b28b80e17af777f9f6a2e370b2af16
MD5 0c62f61d9b8c9a9d88924b59f00fa804
SHA1 8c918348c04b7f9c514b0d3d0b9d30700ac2e41e
SHA512 a29c75ed94c6fb70108fe1ed4b8aa96867f4ff2cc27e9cb4b7ec3dfd5fb34e64fc4b957c0e306709fe7c38aea0330ad4e40cfdfa5c491f022c3277d87411d056
MD5 SHA1 SHA512

Submit Download

memory/448-13-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/448-2-0x00000000771D3000-0x00000000771D4000-memory.dmp

Download

memory/448-1-0x00000000771D2000-0x00000000771D3000-memory.dmp

Download

memory/448-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/2620-36-0x000001DD8D7E0000-0x000001DD8D9D4000-memory.dmp

Download

memory/2620-39-0x000001DDA7FF0000-0x000001DDA8066000-memory.dmp

Download

memory/2620-40-0x000001DD8F710000-0x000001DD8F72E000-memory.dmp

Download