dcrat | 3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599

General

Target

3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
Size

828KB
MD5

22f0ee640dc3afa425a67edeadfd8a00
SHA1

e88fd97e116108a4b765971cdddd7890bab0bbf0
SHA256

3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599
SHA512

db92030c1b38d57173aefa11e26a0d9a973097f496557da1a3f3303097901e344f56bc1c579cf7090ee0b07c168d54c31c45e83ad8f1e5edf595dcae50d86cdc
SSDEEP

12288:u7sJ0qn14m01koie9G0OmMr2LQO1IL2wBRZ5rUOX/TJAAeZdV:r0O4mBmaiR1I93n/TWA6V

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2148	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2148	schtasks.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2908-1-0x0000000001180000-0x0000000001256000-memory.dmp	dcrat
C:\Users\Default\winlogon.exe	dcrat
behavioral1/memory/852-17-0x0000000000990000-0x0000000000A66000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

winlogon.exe

pid process

852 winlogon.exe

pid	process
852	winlogon.exe

Drops file in Program Files directory 7 IoCs

Processes:

3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe

description	ioc	process
File created	C:\Program Files\DVD Maker\Shared\taskhost.exe	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\taskhost.exe	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
File created	C:\Program Files\DVD Maker\Shared\b75386f1303e64	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
File created	C:\Program Files\Uninstall Information\taskhost.exe	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
File created	C:\Program Files\Uninstall Information\b75386f1303e64	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\886983d96e3d3e	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2400	schtasks.exe
2624	schtasks.exe
2196	schtasks.exe
2524	schtasks.exe
2384	schtasks.exe
2668	schtasks.exe
2296	schtasks.exe
2896	schtasks.exe
2812	schtasks.exe
2512	schtasks.exe
2656	schtasks.exe
2736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exewinlogon.exe

pid	process
2908	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
852	winlogon.exe
852	winlogon.exe
852	winlogon.exe
852	winlogon.exe
852	winlogon.exe
852	winlogon.exe
852	winlogon.exe
852	winlogon.exe
852	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

winlogon.exe

pid process

852 winlogon.exe

pid	process
852	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exewinlogon.exe

description	pid	process
Token: SeDebugPrivilege	2908	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
Token: SeDebugPrivilege	852	winlogon.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe

description	pid	process	target process
PID 2908 wrote to memory of 852	2908	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe	winlogon.exe
PID 2908 wrote to memory of 852	2908	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe	winlogon.exe
PID 2908 wrote to memory of 852	2908	3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe
"C:\Users\Admin\AppData\Local\Temp\3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908

C:\Users\Default User\winlogon.exe
"C:\Users\Default User\winlogon.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\DVD Maker\Shared\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\Shared\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files\DVD Maker\Shared\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Default\winlogon.exe
Filesize
828KB

MD5
22f0ee640dc3afa425a67edeadfd8a00

SHA1
e88fd97e116108a4b765971cdddd7890bab0bbf0

SHA256
3b79471f27a94bec8b1f2d203691700f2ecf92cb295abc500b5bce7e49714599

SHA512
db92030c1b38d57173aefa11e26a0d9a973097f496557da1a3f3303097901e344f56bc1c579cf7090ee0b07c168d54c31c45e83ad8f1e5edf595dcae50d86cdc

Download Submit
memory/852-17-0x0000000000990000-0x0000000000A66000-memory.dmp

Filesize
856KB

Download
memory/2908-0-0x000007FEF59E3000-0x000007FEF59E4000-memory.dmp

Filesize
4KB

Download
memory/2908-1-0x0000000001180000-0x0000000001256000-memory.dmp

Filesize
856KB

Download
memory/2908-2-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/2908-18-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads