dcrat | 35ba977ffce79570939ca8a1174c612ebbf213c7d9c67ce4096a77bfc66208e4

Analysis

max time kernel
1719s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solara_Updater.exe
Size 30.1MB
Sample240524-sld2qaac3v
SHA256 35ba977ffce79570939ca8a1174c612ebbf213c7d9c67ce4096a77bfc66208e4
MD5 b80312d70e7353b026d77121c6ca913e
SHA1 b0a4fb617780e7df91c0788de5ff51dbaeb71162
SHA512 0d93831d0ee6d8307fa3305f6d36a1ca1bf457d10383e3f9a5668ae4efb4b6308622729405d3a46936efd32fefb366917e3b9a8436808c78ad2078d0de0561ed
SSDEEP 196608:tF49/UMhhwSE2/CemooOoyz5XPOv5svw1B:sD/hCLooOF/ORsvw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral4/memory/4940-1-0x0000000000060000-0x0000000001E82000-memory.dmp	dcrat
behavioral4/files/0x00090000000233f1-8.dat	dcrat
behavioral4/files/0x00070000000233f5-33.dat	dcrat
behavioral4/memory/4988-35-0x00000000001B0000-0x0000000000360000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Solara_Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
2792	svchost.exe
3192	explorer.exe
4988	Providerdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	svchost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1320	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3192	explorer.exe
3192	explorer.exe
3192	explorer.exe
3192	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	Providerdhcp.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2792	4940	Solara_Updater.exe	88
PID 4940 wrote to memory of 2792	4940	Solara_Updater.exe	88
PID 4940 wrote to memory of 2792	4940	Solara_Updater.exe	88
PID 4940 wrote to memory of 3192	4940	Solara_Updater.exe	89
PID 4940 wrote to memory of 3192	4940	Solara_Updater.exe	89
PID 2792 wrote to memory of 4760	2792	svchost.exe	91
PID 2792 wrote to memory of 4760	2792	svchost.exe	91
PID 2792 wrote to memory of 4760	2792	svchost.exe	91
PID 4760 wrote to memory of 5016	4760	WScript.exe	95
PID 4760 wrote to memory of 5016	4760	WScript.exe	95
PID 4760 wrote to memory of 5016	4760	WScript.exe	95
PID 5016 wrote to memory of 4988	5016	cmd.exe	97
PID 5016 wrote to memory of 4988	5016	cmd.exe	97
PID 5016 wrote to memory of 1320	5016	cmd.exe	99
PID 5016 wrote to memory of 1320	5016	cmd.exe	99
PID 5016 wrote to memory of 1320	5016	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe
"C:\Users\Admin\AppData\Local\Temp\Solara_Updater.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\browserwebRuntime\MDMLXUJEqkvGh8M96AhoXet.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\browserwebRuntime\cs86FzarqhtTNKqV9uSI7A.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\browserwebRuntime\Providerdhcp.exe
        
        "C:\browserwebRuntime\Providerdhcp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:1320
- C:\Users\Admin\AppData\Local\Temp\explorer.exe
  "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe

Path C:\Users\Admin\AppData\Local\Temp\explorer.exe
Size 28.2MB
SHA256 3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c
MD5 fe94c576b99dcc99b1c82fce00af97ab
SHA1 aea717754ba2ba8fb3981bb87837b150ab659023
SHA512 9bfbc9063924c61a5fe5338ea7c332d764575d62e80ac20356a9d10901b40266dd536d19274302ddf1cdc8b92fdb9c0bda4d807ef012d55db7f5e28453b16b34
SSDEEP 98304:FNE2/fNpo5pemooOoC3iQ5Ao2oPOt6rv8TT5bNGcP/NT41ue+ROhNZkJKfyq1t4C:DE2/CemooOoyz5XPOv5svw1B6
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 1.9MB
SHA256 a6e7f88b045c6b5b1e12c8e4072301496e40c7b5e9d859dace08e25c694dec0d
MD5 e7b473e76ad867497f815ab55602ced7
SHA1 e23823e15d2be34f36e498467f4df190276b4b61
SHA512 9195c334393c3af90f34cf85381860015f7fa5d9c420bdda26f1aab4baa10ab173cf619c9c3365931e44981eccdb1c427a40e926d39bb977db95b26c4f4ac8f4
SSDEEP 49152:JbA341ItaW3jzlpHnHxFUdufJLkHsYqwEF1z8:JbZ4FjLHnHrUMhQFqwEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MDMLXUJEqkvGh8M96AhoXet.vbe

Path C:\browserwebRuntime\MDMLXUJEqkvGh8M96AhoXet.vbe
Size 216B
SHA256 78657f87160c95a9c7f21c5bc3ea686b96ae4ece8be0bd87967dd1ed6d05a46c
MD5 32deedc3746912bf08ecf8af644f099a
SHA1 3dae47b734c2850740fb93be4994717bc73d2f22
SHA512 86afbf2582f48902febe196e9edad592831ee160d2644578f7bd55ab56645a2246263deeea0e0ca762036927cb2d76af57ba82b394c5bdd1d249d360e55f155d
MD5 SHA1 SHA512

Submit Download

Providerdhcp.exe

Path C:\browserwebRuntime\Providerdhcp.exe
Size 1.7MB
SHA256 75796a7a589581a012b3589bbac888410dfa10c1c7473ca4306e81d95b660a6d
MD5 a280d90663f218a2ad2a647157727d5b
SHA1 aed0932c2cf9b7e32a55e2bf74226139a4528ff4
SHA512 bd1d8b1262d48abbdd087642c4e1b3286a09e4a52b2cc6e904c9ce24ab9fbfc26370907909b5e1be448b149a6f3147b8dba8b424250365b978d13472590dd28e
SSDEEP 24576:kIta7P6ldP/J9fIC1Xb5lpHnHqu0yrijdufJLS+8HsYNAwEF1V8BOV:kItaW3jzlpHnHxFUdufJLkHsYqwEF1z
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs86FzarqhtTNKqV9uSI7A.bat

Path C:\browserwebRuntime\cs86FzarqhtTNKqV9uSI7A.bat
Size 151B
SHA256 3a17d27b4342ced9cc61acd67ab753a81ef96363f866976fd3d1b1462ad64945
MD5 923b999db9ce49bb01166e1d3ca2864e
SHA1 3e2f2d52577752b1528abcda8cffa62ed80de84a
SHA512 1f2ff675f1a889b892ec78daa9fdbb02aa3395d3dd917f563bad623f4f566196aa5111cdc99dd605f58579b67bd20579e42cb47aa95ab1d0eea86520461ea24a
MD5 SHA1 SHA512

Submit Download

memory/4940-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

Download

memory/4940-1-0x0000000000060000-0x0000000001E82000-memory.dmp

Download

memory/4940-2-0x00000000067F0000-0x000000000688C000-memory.dmp

Download

memory/4988-35-0x00000000001B0000-0x0000000000360000-memory.dmp

Download

memory/4988-36-0x0000000000A20000-0x0000000000A2E000-memory.dmp

Download