dcrat | 42b4f9127570347763ae3f84e80c2aa4c85af0f5586bca90458f2574f4f07417

General

Target
virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
Size 1.0MB
Sample240528-slyq5aba83
SHA256 42b4f9127570347763ae3f84e80c2aa4c85af0f5586bca90458f2574f4f07417
MD5 358b38213a141c1f3ffd63e2c26638b0
SHA1 6fb08dbc00dd027e83f8fbbb33ee10870289209c
SHA512 50cb5e35151de0c20b2c8a61d58748007af209661d68c09cf8f283c314ccf202217d94860a3672d9943f11619ed1899cd846de00580c9ffeebb767cce0b5e82e
SSDEEP 12288:/ubxAa9sUFxZ8oq7URPvyKBozWeL+vSgmtjJcDVrCTZSXlVB0mGEB0aNN/cPUeWl:g9sUFxZq7URPt6RL6nBrEZUjGE/L8YZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	5056	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	5056	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	5056	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	5056	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	5056	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	5056	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	5056	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	5056	schtasks.exe	84

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2484-0-0x0000000000850000-0x0000000000962000-memory.dmp	dcrat

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\PackageManifests\dwm.exe	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\6cb0b6c459d5d3	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\csrss.exe	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\886983d96e3d3e	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4212	schtasks.exe
1684	schtasks.exe
4552	schtasks.exe
4948	schtasks.exe
2116	schtasks.exe
4108	schtasks.exe
4364	schtasks.exe
1300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_358b38213a141c1f3ffd63e2c26638b0.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\ssh\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\ssh\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\ssh\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\PackageManifests\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\PackageManifests\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300