dcrat | 3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75

General

Target
1f9c3cddc1c0c5f3411caa896e02350a.exe
Size 1.1MB
Sample240530-mdm2rsfa65
SHA256 3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75
MD5 1f9c3cddc1c0c5f3411caa896e02350a
SHA1 5c7e7074e9ee1b446890deb4eda500d5be074092
SHA512 8cd0bd635431b23d7f29fa274d0d2bef1da0c94cbf5b927c34d12a67d1a19b7ead6b46257e1bb8d1880e72965ee7b068c1d059bb317fcaa3917c71993efb9bb9
SSDEEP 24576:U2G/nvxW3Ww0trmGK9uhJ4bNJYrvyunNnLskPF:UbA30CGK9ve9n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	1576	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	1576	schtasks.exe	92

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023403-10.dat	dcrat
behavioral2/memory/3340-13-0x0000000000960000-0x0000000000A36000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	1f9c3cddc1c0c5f3411caa896e02350a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	chaindhcp.exe

Executes dropped EXE 2 IoCs

pid	Process
3340	chaindhcp.exe
3956	Idle.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe	chaindhcp.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe	chaindhcp.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\6cb0b6c459d5d3	chaindhcp.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsass.exe	chaindhcp.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\6203df4a6bafc7	chaindhcp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\sihost.exe	chaindhcp.exe
File created	C:\Windows\assembly\66fc9ff0ee96c2	chaindhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1008	schtasks.exe
4072	schtasks.exe
2684	schtasks.exe
4768	schtasks.exe
4748	schtasks.exe
4252	schtasks.exe
2536	schtasks.exe
2236	schtasks.exe
3976	schtasks.exe
1416	schtasks.exe
2044	schtasks.exe
4936	schtasks.exe
2424	schtasks.exe
2440	schtasks.exe
3160	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	1f9c3cddc1c0c5f3411caa896e02350a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3340	chaindhcp.exe
3340	chaindhcp.exe
3340	chaindhcp.exe
3956	Idle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	chaindhcp.exe
Token: SeDebugPrivilege	3956	Idle.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 5096	4344	1f9c3cddc1c0c5f3411caa896e02350a.exe	83
PID 4344 wrote to memory of 5096	4344	1f9c3cddc1c0c5f3411caa896e02350a.exe	83
PID 4344 wrote to memory of 5096	4344	1f9c3cddc1c0c5f3411caa896e02350a.exe	83
PID 5096 wrote to memory of 2060	5096	WScript.exe	93
PID 5096 wrote to memory of 2060	5096	WScript.exe	93
PID 5096 wrote to memory of 2060	5096	WScript.exe	93
PID 2060 wrote to memory of 3340	2060	cmd.exe	95
PID 2060 wrote to memory of 3340	2060	cmd.exe	95
PID 3340 wrote to memory of 3956	3340	chaindhcp.exe	112
PID 3340 wrote to memory of 3956	3340	chaindhcp.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1f9c3cddc1c0c5f3411caa896e02350a.exe
"C:\Users\Admin\AppData\Local\Temp\1f9c3cddc1c0c5f3411caa896e02350a.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BlockagentServernetcommon\dWMX88gCACXoKvtETHr5LRHJRP.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BlockagentServernetcommon\iMMFNCJn73wO9QJjxuedDCGIZ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\BlockagentServernetcommon\chaindhcp.exe
      "C:\BlockagentServernetcommon\chaindhcp.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3340
    - - C:\BlockagentServernetcommon\Idle.exe
        
        "C:\BlockagentServernetcommon\Idle.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\BlockagentServernetcommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\BlockagentServernetcommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\BlockagentServernetcommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\assembly\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\assembly\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\BlockagentServernetcommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\BlockagentServernetcommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\BlockagentServernetcommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chaindhcp.exe

Path C:\BlockagentServernetcommon\chaindhcp.exe
Size 828KB
SHA256 ce9beff66fd8ae2b916b2490e5c8da04c4316f98de24304c56417ea0bfd28451
MD5 64bce0f72bd60afa24806c4e8184ba5d
SHA1 633df6157e70b70a4606e3f9f63fdc9db17dba14
SHA512 efeb232f08d86465cf88d2050e3e52818b877621d29b9bb1eab8f44238ef02b7495bb11910ed1709b8058d104269e05d0e31557f4bbe1afc0ba0bf3baf8f5191
SSDEEP 12288:dynt4omK9uhJvyJb6KJYrvyunxsMAapQygks+hPeup:dmGK9uhJ4bNJYrvyunNnLskP
MD5 SHA1 SHA512 SSDEEP

Submit Download

dWMX88gCACXoKvtETHr5LRHJRP.vbe

Path C:\BlockagentServernetcommon\dWMX88gCACXoKvtETHr5LRHJRP.vbe
Size 227B
SHA256 2304bdc77b852533e29614bd26e244c64fee9c2e9c5ea2a8c4e4579fd8ade547
MD5 d40a0d6875e6223f9e5c4c9613c975b4
SHA1 c605b32b588597dce9916053944eccef138d3b6e
SHA512 2e2570f2d0af1fde57fd7ef1812981e75daed6a906f2a359e89713dabf2df204b4788c76adcdaca8bb9f3046a3ee9cf5731bc84105ce82af17953c7f7197ff78
MD5 SHA1 SHA512

Submit Download

iMMFNCJn73wO9QJjxuedDCGIZ.bat

Path C:\BlockagentServernetcommon\iMMFNCJn73wO9QJjxuedDCGIZ.bat
Size 44B
SHA256 31f24dac6e2778c338307d6ccdf2e7e8b8626266bfef12af006b20b4a27c05af
MD5 eb6b7f7bea1252f5f5bfcc2c9e0164e5
SHA1 ec7bfe67793b4b3f4842334e9476a5e9a2f95688
SHA512 02807c217a7e93cdfd7cb60c0bf9110ef7585b0d1843599bc3c4537481ebfe942f3f41b9b71c4aa26b2f4ef5619338d81f0474a387c859942e5814d49f8f3939
MD5 SHA1 SHA512

Submit Download

memory/3340-13-0x0000000000960000-0x0000000000A36000-memory.dmp

Download

memory/3340-12-0x00007FFE960F3000-0x00007FFE960F5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads