dcrat | c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581

General

Target
B817873FADD6AF466832355A47D1E9AE.exe
Size 1000KB
Sample240528-v3n95aee64
SHA256 c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581
MD5 b817873fadd6af466832355a47d1e9ae
SHA1 e06db2031ed495fd73c7c0d60cb581702f668ec4
SHA512 1ed7a3060d0f7298f969152968b18db5211ca087480ef650415b297747576e033151bfb5b6494e0e1b79ddc609b25412a3707c475a8cd12f3fca95894a6e4a77
SSDEEP 24576:jzZgodRLKBXQEyRt7d/bZJfKp491BaDwoA:jz9W29vlp9Ok
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5552	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5136	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5412	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5436	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5556	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5756	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5628	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5340	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5336	3568	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	3568	schtasks.exe	91

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2620-1-0x0000000000A60000-0x0000000000B62000-memory.dmp	dcrat
behavioral2/files/0x0007000000023274-13.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	B817873FADD6AF466832355A47D1E9AE.exe

Executes dropped EXE 1 IoCs

pid	Process
4676	StartMenuExperienceHost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\de-DE\winlogon.exe	B817873FADD6AF466832355A47D1E9AE.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\winlogon.exe	B817873FADD6AF466832355A47D1E9AE.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\cc11b995f2a76d	B817873FADD6AF466832355A47D1E9AE.exe
File created	C:\Program Files\Windows Photo Viewer\StartMenuExperienceHost.exe	B817873FADD6AF466832355A47D1E9AE.exe
File created	C:\Program Files\Windows Photo Viewer\55b276f4edf653	B817873FADD6AF466832355A47D1E9AE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5436	schtasks.exe
1644	schtasks.exe
4148	schtasks.exe
1936	schtasks.exe
5136	schtasks.exe
5340	schtasks.exe
5412	schtasks.exe
5556	schtasks.exe
5628	schtasks.exe
840	schtasks.exe
4548	schtasks.exe
5336	schtasks.exe
4252	schtasks.exe
5756	schtasks.exe
5320	schtasks.exe
5552	schtasks.exe
1204	schtasks.exe
2568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2620	B817873FADD6AF466832355A47D1E9AE.exe
2620	B817873FADD6AF466832355A47D1E9AE.exe
2620	B817873FADD6AF466832355A47D1E9AE.exe
2620	B817873FADD6AF466832355A47D1E9AE.exe
2620	B817873FADD6AF466832355A47D1E9AE.exe
2620	B817873FADD6AF466832355A47D1E9AE.exe
2620	B817873FADD6AF466832355A47D1E9AE.exe
2620	B817873FADD6AF466832355A47D1E9AE.exe
4676	StartMenuExperienceHost.exe
4676	StartMenuExperienceHost.exe
4676	StartMenuExperienceHost.exe
4676	StartMenuExperienceHost.exe
4676	StartMenuExperienceHost.exe
4676	StartMenuExperienceHost.exe
4676	StartMenuExperienceHost.exe
4676	StartMenuExperienceHost.exe
4676	StartMenuExperienceHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4676	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	B817873FADD6AF466832355A47D1E9AE.exe
Token: SeDebugPrivilege	4676	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 4676	2620	B817873FADD6AF466832355A47D1E9AE.exe	110
PID 2620 wrote to memory of 4676	2620	B817873FADD6AF466832355A47D1E9AE.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\B817873FADD6AF466832355A47D1E9AE.exe
"C:\Users\Admin\AppData\Local\Temp\B817873FADD6AF466832355A47D1E9AE.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files\Windows Photo Viewer\StartMenuExperienceHost.exe
  "C:\Program Files\Windows Photo Viewer\StartMenuExperienceHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\odt\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\odt\smss.exe
Size 1000KB
SHA256 c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581
MD5 b817873fadd6af466832355a47d1e9ae
SHA1 e06db2031ed495fd73c7c0d60cb581702f668ec4
SHA512 1ed7a3060d0f7298f969152968b18db5211ca087480ef650415b297747576e033151bfb5b6494e0e1b79ddc609b25412a3707c475a8cd12f3fca95894a6e4a77
SSDEEP 24576:jzZgodRLKBXQEyRt7d/bZJfKp491BaDwoA:jz9W29vlp9Ok
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2620-0-0x00007FFD84573000-0x00007FFD84575000-memory.dmp

Download

memory/2620-1-0x0000000000A60000-0x0000000000B62000-memory.dmp

Download

memory/2620-2-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Download

memory/2620-3-0x000000001B670000-0x000000001B68C000-memory.dmp

Download

memory/2620-4-0x000000001BE40000-0x000000001BE90000-memory.dmp

Download

memory/2620-28-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads