dcrat | 8d8b279498b2eba1b946fbe8c2dcef716e8650196461f3828be5878e8c5d72a9

General

Target
4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
Size 1003KB
Sample240529-kb93eahc57
SHA256 8d8b279498b2eba1b946fbe8c2dcef716e8650196461f3828be5878e8c5d72a9
MD5 4cd520665c4481af43c46436cfa2667f
SHA1 f08e76e5595893fb2437d50f44e298f110162fbe
SHA512 b909e0e88c7ab402e854735c3c1ca896c4d015eb6977c4e3d4dc7d39604c872282222ccbd2e66005b7ee32d59e7b83fa664098e309a2f28ddf278a7cb15d77e3
SSDEEP 12288:rmprt3mTskO88N58kW99AN2BS+VMCWLzJxAkrz/IjIHlaQfO4SClf6NtsgZW:a/2TsV88dsGB+VMdLzMEHzG+lSI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	716	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	2540	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2540	schtasks.exe	82

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1416-1-0x0000000000B80000-0x0000000000C82000-memory.dmp	dcrat
behavioral2/files/0x000700000002344a-13.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4608	lsass.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\upfc.exe	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\ea1d8f6d871115	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Services\sihost.exe	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Services\66fc9ff0ee96c2	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\DiagTrack\backgroundTaskHost.exe	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
File created	C:\Windows\DiagTrack\eddb19405b7ce1	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
File created	C:\Windows\SoftwareDistribution\DataStore\RuntimeBroker.exe	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\RuntimeBroker.exe	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
File created	C:\Windows\SoftwareDistribution\DataStore\9e8d7a4ca61bd9	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
836	schtasks.exe
3116	schtasks.exe
1968	schtasks.exe
4764	schtasks.exe
2708	schtasks.exe
3016	schtasks.exe
464	schtasks.exe
4848	schtasks.exe
4172	schtasks.exe
2704	schtasks.exe
3848	schtasks.exe
452	schtasks.exe
3712	schtasks.exe
1580	schtasks.exe
2840	schtasks.exe
4060	schtasks.exe
3572	schtasks.exe
1776	schtasks.exe
3244	schtasks.exe
716	schtasks.exe
644	schtasks.exe
4152	schtasks.exe
2076	schtasks.exe
1828	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
4608	lsass.exe
4608	lsass.exe
4608	lsass.exe
4608	lsass.exe
4608	lsass.exe
4608	lsass.exe
4608	lsass.exe
4608	lsass.exe
4608	lsass.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4608	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
Token: SeDebugPrivilege	4608	lsass.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2480	1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe	108
PID 1416 wrote to memory of 2480	1416	4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe	108
PID 2480 wrote to memory of 4188	2480	cmd.exe	110
PID 2480 wrote to memory of 4188	2480	cmd.exe	110
PID 2480 wrote to memory of 4608	2480	cmd.exe	115
PID 2480 wrote to memory of 4608	2480	cmd.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4cd520665c4481af43c46436cfa2667f_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5LGkMa40nN.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4188
- - C:\Users\All Users\lsass.exe
    "C:\Users\All Users\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\SoftwareDistribution\DataStore\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\DataStore\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\SoftwareDistribution\DataStore\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Services\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Services\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Windows\DiagTrack\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\DiagTrack\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\DiagTrack\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmon.exe

Path C:\Recovery\WindowsRE\sysmon.exe
Size 1003KB
SHA256 8d8b279498b2eba1b946fbe8c2dcef716e8650196461f3828be5878e8c5d72a9
MD5 4cd520665c4481af43c46436cfa2667f
SHA1 f08e76e5595893fb2437d50f44e298f110162fbe
SHA512 b909e0e88c7ab402e854735c3c1ca896c4d015eb6977c4e3d4dc7d39604c872282222ccbd2e66005b7ee32d59e7b83fa664098e309a2f28ddf278a7cb15d77e3
SSDEEP 12288:rmprt3mTskO88N58kW99AN2BS+VMCWLzJxAkrz/IjIHlaQfO4SClf6NtsgZW:a/2TsV88dsGB+VMdLzMEHzG+lSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

5LGkMa40nN.bat

Path C:\Users\Admin\AppData\Local\Temp\5LGkMa40nN.bat
Size 193B
SHA256 4223a3542a455b108b5bf883b8eacc5b861617a3ac6fe443dfc0c240cdb5e3c1
MD5 c8498ddd0d33a0dddc9f0597ab1709e0
SHA1 1ab6651b992bce7755cd8d48492f67a05d507883
SHA512 714aa2ff64c7185ca79ed2635b9d41a6bb5f0be3a457265f67d662b52d88983c19a55ba243003dc984ba32511226331191f84d6a1af18a22dac548792e2e6158
MD5 SHA1 SHA512

Submit Download

memory/1416-0-0x00007FFD7B753000-0x00007FFD7B755000-memory.dmp

Download

memory/1416-1-0x0000000000B80000-0x0000000000C82000-memory.dmp

Download

memory/1416-2-0x00007FFD7B750000-0x00007FFD7C211000-memory.dmp

Download

memory/1416-3-0x000000001B7A0000-0x000000001B7BC000-memory.dmp

Download

memory/1416-4-0x000000001B960000-0x000000001B9B0000-memory.dmp

Download

memory/1416-26-0x00007FFD7B750000-0x00007FFD7C211000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads