dcrat | e6f5a22e02d955d98c78d0c327071b908e17b033be56a979f1350d24b399f0d7

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 1.5MB
Sample240602-kcw7yagg55
SHA256 e6f5a22e02d955d98c78d0c327071b908e17b033be56a979f1350d24b399f0d7
MD5 175a4d8eac271af8d3bad9650aa69de2
SHA1 50dc4f5bbc8534d448c3bfdb399895c89f35f429
SHA512 0d07d210133147144cbd0f72be0a893b2bb14124a50051e83b48d21d7d0ed4dcbb835b4ddef82cb6a06e8afeef3dca6b2de6146e338a866fba5936404b2cd7a1
SSDEEP 24576:u2G/nvxW3WieCu5Rqq93u1h7mGIPOD5HRGbkFc9QomqJ:ubA3ju5Ro1Fm+kAFQx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	1944	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	1944	schtasks.exe	94

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002342b-10.dat	dcrat
behavioral2/memory/4204-13-0x00000000006A0000-0x00000000007D2000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	test.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	bridgeBrokerdll.exe

Executes dropped EXE 2 IoCs

pid	Process
4204	bridgeBrokerdll.exe
1068	SppExtComObj.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\DESIGNER\services.exe	bridgeBrokerdll.exe
File created	C:\Program Files\Common Files\DESIGNER\c5b4cb5e9653cc	bridgeBrokerdll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2488	schtasks.exe
2844	schtasks.exe
3436	schtasks.exe
2312	schtasks.exe
952	schtasks.exe
2504	schtasks.exe
4968	schtasks.exe
1356	schtasks.exe
4100	schtasks.exe
1592	schtasks.exe
4596	schtasks.exe
2760	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	test.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	bridgeBrokerdll.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4204	bridgeBrokerdll.exe
4204	bridgeBrokerdll.exe
4204	bridgeBrokerdll.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe
1068	SppExtComObj.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1068	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	bridgeBrokerdll.exe
Token: SeDebugPrivilege	1068	SppExtComObj.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4084	1868	test.exe	83
PID 1868 wrote to memory of 4084	1868	test.exe	83
PID 1868 wrote to memory of 4084	1868	test.exe	83
PID 4084 wrote to memory of 4160	4084	WScript.exe	96
PID 4084 wrote to memory of 4160	4084	WScript.exe	96
PID 4084 wrote to memory of 4160	4084	WScript.exe	96
PID 4160 wrote to memory of 4204	4160	cmd.exe	98
PID 4160 wrote to memory of 4204	4160	cmd.exe	98
PID 4204 wrote to memory of 4412	4204	bridgeBrokerdll.exe	113
PID 4204 wrote to memory of 4412	4204	bridgeBrokerdll.exe	113
PID 4412 wrote to memory of 1672	4412	cmd.exe	115
PID 4412 wrote to memory of 1672	4412	cmd.exe	115
PID 4412 wrote to memory of 1068	4412	cmd.exe	116
PID 4412 wrote to memory of 1068	4412	cmd.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\webPerf\5rLin3I.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\webPerf\d7F5DOi3xKe.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\webPerf\bridgeBrokerdll.exe
      "C:\webPerf\bridgeBrokerdll.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7WJUieq5t9.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4412
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1672
      - C:\Users\Admin\Videos\SppExtComObj.exe
        
        "C:\Users\Admin\Videos\SppExtComObj.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\webPerf\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\webPerf\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\webPerf\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Videos\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\Videos\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Videos\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\DESIGNER\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\DESIGNER\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\webPerf\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\webPerf\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\webPerf\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7WJUieq5t9.bat

Path C:\Users\Admin\AppData\Local\Temp\7WJUieq5t9.bat
Size 203B
SHA256 e5887c8a050679269dd361ce97ed2ceb48ed35d444c691bf7ed2aba79bf69ab6
MD5 4b6cfaa92d700f3d3f871bc2b22ed8ed
SHA1 23a4902f92a4e23d951390884b1a6313fabe3c35
SHA512 a6d9bf568819a298649330fa3f3f86955cb21a0bdde60d784f6bcf05dbc243f12c86649ae73a1b9589337dc7045a0938474b425772ad20fd5545b5a2c011cca3
MD5 SHA1 SHA512

Submit Download

5rLin3I.vbe

Path C:\webPerf\5rLin3I.vbe
Size 195B
SHA256 57258478161967ccc2d23a604df94f05a05bb6556e703ffd13638aba179c0e96
MD5 0e2aadd984b718c4f288f94f542c1b44
SHA1 e9c8c6401a607ad381a8807d7bc608c0067fc648
SHA512 a3c172c0b7c49d8b65cbe2c4ba13a64a01fdb3289f0368f631c3db0eee904a952b42a5c01b53433432546c7e772b3e3e07231429abe695a788a2d53bcac5d0b3
MD5 SHA1 SHA512

Submit Download

bridgeBrokerdll.exe

Path C:\webPerf\bridgeBrokerdll.exe
Size 1.2MB
SHA256 9ae1999485774e4b008429ce2325f054276b758c7f6dccd559ecc800d135e55e
MD5 00896907be62c906323fc1eb97f24558
SHA1 9936310477ffd10b0f76b66d93e2e0b99d3fcecb
SHA512 ee8b6e121c6154bea76eac1f7d93c3b951570c03099bc60de66e8da03dd86f6a563d6fa6f5d552fc9c62350683c72241f3445399e2ff0e88dda1ed68b60267b0
SSDEEP 12288:qLvt4rnMRqq9vF8iun1hz3mkLDWuOZ3CkODTtHCeG+wHNkFcv1pGXHHJOl87BC+u:q5Rqq93u1h7mGIPOD5HRGbkFc9Qomq
MD5 SHA1 SHA512 SSDEEP

Submit Download

d7F5DOi3xKe.bat

Path C:\webPerf\d7F5DOi3xKe.bat
Size 32B
SHA256 8e1c3865bf42ea64999893d389632b236f0b660258eeba7268ee1ad8392c3b18
MD5 fee196a7842136f3575348c84982f5fd
SHA1 69a3b54b98ece770cea630a09afdd4b6344e8aeb
SHA512 73f3f330c916a1e723a5fe40931b18c461ddb45d3497c23655b97185c63107f6176647a12d74d7ecb240593080bb98d12d4b181d21b32c61ef005031f86681da
MD5 SHA1 SHA512

Submit Download

memory/4204-12-0x00007FFCCB103000-0x00007FFCCB105000-memory.dmp

Download

memory/4204-13-0x00000000006A0000-0x00000000007D2000-memory.dmp

Download

memory/4204-17-0x00000000010B0000-0x00000000010BC000-memory.dmp

Download

memory/4204-16-0x0000000002A40000-0x0000000002A56000-memory.dmp

Download

memory/4204-15-0x000000001BB30000-0x000000001BB80000-memory.dmp

Download

memory/4204-14-0x0000000002A20000-0x0000000002A3C000-memory.dmp

Download