dcrat | 2a74767d7f14e9b65318f9210bf2371ed08b46ae1eb49f6367e20d5d82dad470

General

Target
DCRatBuild.exe
Size 1.1MB
Sample240530-ja322abg32
SHA256 2a74767d7f14e9b65318f9210bf2371ed08b46ae1eb49f6367e20d5d82dad470
MD5 2ab8ff5b7621758d77e24b1852beb01a
SHA1 b0ad327f9d520c8d9b3043c0944a4f8c85bca394
SHA512 78cd9729e7b55b06aa95242e7d9fde36b31b52031fe9c6319d3acacbe2c5a7682c955f7cca1c838465b011d84fcf4d633de49478cd7a26ae65b299126e5abe29
SSDEEP 24576:U2G/nvxW3Ww0tHiU0YJ2/+Fv/maIfrLeEhsnW4S9:UbA30HiU0Yg+RIGEh/D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023423-10.dat	dcrat
behavioral2/memory/3924-13-0x00000000007F0000-0x00000000008C6000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	comfontCrt.exe

Executes dropped EXE 1 IoCs

pid	Process
3924	comfontCrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	DCRatBuild.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3924	comfontCrt.exe
3924	comfontCrt.exe
3924	comfontCrt.exe
3924	comfontCrt.exe
3924	comfontCrt.exe
3924	comfontCrt.exe
3924	comfontCrt.exe
3924	comfontCrt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	comfontCrt.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2484	4904	DCRatBuild.exe	84
PID 4904 wrote to memory of 2484	4904	DCRatBuild.exe	84
PID 4904 wrote to memory of 2484	4904	DCRatBuild.exe	84
PID 2484 wrote to memory of 5016	2484	WScript.exe	90
PID 2484 wrote to memory of 5016	2484	WScript.exe	90
PID 2484 wrote to memory of 5016	2484	WScript.exe	90
PID 5016 wrote to memory of 3924	5016	cmd.exe	92
PID 5016 wrote to memory of 3924	5016	cmd.exe	92
PID 3924 wrote to memory of 4288	3924	comfontCrt.exe	100
PID 3924 wrote to memory of 4288	3924	comfontCrt.exe	100
PID 4288 wrote to memory of 4312	4288	cmd.exe	102
PID 4288 wrote to memory of 4312	4288	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BridgeHyperAgentperfdll\jNhFnGx.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BridgeHyperAgentperfdll\czB6j.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\BridgeHyperAgentperfdll\comfontCrt.exe
      "C:\BridgeHyperAgentperfdll\comfontCrt.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OJl0oPUMwf.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4288
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

comfontCrt.exe

Path C:\BridgeHyperAgentperfdll\comfontCrt.exe
Size 827KB
SHA256 6525bbdaf820b751bc6b9203bdd90c5a4b0d77e8111870cf2ba2255b624a900f
MD5 79fcd5a94f5497b9cb526ef11862f531
SHA1 8229cdd5f60ccc3b6606abc3538d2bcf540ae1a4
SHA512 91b1bc36bdfd71f064551541f69f4f6bcb93f51bffae29217c95ab197ecc4bafdb1bf0243b9b3183579892270f31d7f48403e087e8d3b4dcba4f974497f99f62
SSDEEP 12288:GHC8PrYY2ZZG2wdc+Fv/ufPafgfrLeEhX1rOuC26L7wZoeYwIS:GiU0YJ2/+Fv/maIfrLeEhsnW4S
MD5 SHA1 SHA512 SSDEEP

Submit Download

czB6j.bat

Path C:\BridgeHyperAgentperfdll\czB6j.bat
Size 43B
SHA256 3b23aba50545771c8bf16572dc035ccb70b422fee7f2839360d2d5014e67a0b7
MD5 0eb2255b72e485f22aa4f86de5f1a6f5
SHA1 05a8b90ce1325b784177caf557d250dc6b3087cb
SHA512 e2ae99747ccfc8408f35db2c5b7cca94c6f35105c6390801b434606e90a48a39e4ca1c814c414674092e4c5e84ba30f725e04ba6f8e41006d9802c5977d7c3cf
MD5 SHA1 SHA512

Submit Download

jNhFnGx.vbe

Path C:\BridgeHyperAgentperfdll\jNhFnGx.vbe
Size 205B
SHA256 7f805a3f8ff6e01e264617f4f5c34f272b3202db1df61c01bcd26888d5aa579d
MD5 098c91774d311c88d167bfbcf92894eb
SHA1 c089de7cc9cc48e2a6ce3911dc537cae82eb4b01
SHA512 74e8e75c024fc93223af4c5dea49ae883dc86c1547f3df433e7efe700d3d5807b38abbc9797652aed6f1eabf5db4e49631ee8186c4b15d5ee43bfcfe9aea6369
MD5 SHA1 SHA512

Submit Download

OJl0oPUMwf.bat

Path C:\Users\Admin\AppData\Local\Temp\OJl0oPUMwf.bat
Size 210B
SHA256 7766146e2ff0c112fb1f3baaf8a7edf215335938cb3bc82b90cd03213c168af2
MD5 514225438b96e46fee8e33a7eefdc647
SHA1 d8ffc3ec61979266a79773b9d9539b61b638b7d2
SHA512 764cb900d7656e3081abbc355337f1e3feca549ce2720c0e42dea5d0c1fe5619611dcd1197dfdab36fb11d5e5295dd13be6cd30b51b83d70ef3cec59776c0eb1
MD5 SHA1 SHA512

Submit Download

memory/3924-12-0x00007FFDB12B3000-0x00007FFDB12B5000-memory.dmp

Download

memory/3924-13-0x00000000007F0000-0x00000000008C6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads