dcrat | cf1f6eb66912ff5ad30f8940accdb1df9bb2f8f8cdf3f8d45a4febd48c5641b9

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nursultan.exe
Size 1.7MB
Sample240603-ebfkxaab3y
SHA256 cf1f6eb66912ff5ad30f8940accdb1df9bb2f8f8cdf3f8d45a4febd48c5641b9
MD5 167a7a1acbb331c7120f7c523b77b63a
SHA1 e4ab977acdb17dbbf2caa51a75d7fb67c4dc433b
SHA512 2145a9c4414e814e2d6d88c403e0ade70eef266b1307f8c2cdc3822a7829e5e2273932f128981c96cfede5d719b5e9a0654c4fb395f19e74dd2bb020cf501a3f
SSDEEP 24576:P2G/nvxW3WayX0tmpK3Xgjh1gMTVn/8E6Oqi4yEBCknTXCZ/UzGGq1lM/XP2YFn+:PbA37ykwpKM+sHWyGXvAIbFCZ2XC1f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\INF\\smss.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\INF\\smss.exe\", \"C:\\ProviderInto\\taskhostw.exe\""	blocksurrogate.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	1984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	1984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	1984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	1984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	1984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	1984	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002341b-10.dat	dcrat
behavioral2/memory/4372-13-0x0000000000950000-0x0000000000AAC000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	Nursultan.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	blocksurrogate.exe

Executes dropped EXE 2 IoCs

pid	Process
4372	blocksurrogate.exe
4592	taskhostw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\INF\\smss.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\INF\\smss.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\ProviderInto\\taskhostw.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\ProviderInto\\taskhostw.exe\""	blocksurrogate.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ipinfo.io
27	ipinfo.io

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\INF\smss.exe	blocksurrogate.exe
File opened for modification	C:\Windows\INF\smss.exe	blocksurrogate.exe
File created	C:\Windows\INF\69ddcba757bf72	blocksurrogate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4048	schtasks.exe
3252	schtasks.exe
2948	schtasks.exe
4496	schtasks.exe
2512	schtasks.exe
4792	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	Nursultan.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4372	blocksurrogate.exe
4592	taskhostw.exe
4592	taskhostw.exe
4592	taskhostw.exe
4592	taskhostw.exe
4592	taskhostw.exe
4592	taskhostw.exe
4592	taskhostw.exe
4592	taskhostw.exe
4592	taskhostw.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4592	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	blocksurrogate.exe
Token: SeDebugPrivilege	4592	taskhostw.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2860	4448	Nursultan.exe	81
PID 4448 wrote to memory of 2860	4448	Nursultan.exe	81
PID 4448 wrote to memory of 2860	4448	Nursultan.exe	81
PID 2860 wrote to memory of 2928	2860	WScript.exe	91
PID 2860 wrote to memory of 2928	2860	WScript.exe	91
PID 2860 wrote to memory of 2928	2860	WScript.exe	91
PID 2928 wrote to memory of 4372	2928	cmd.exe	93
PID 2928 wrote to memory of 4372	2928	cmd.exe	93
PID 4372 wrote to memory of 4592	4372	blocksurrogate.exe	100
PID 4372 wrote to memory of 4592	4372	blocksurrogate.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProviderInto\bg4vLJUaDkf5tC.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProviderInto\NmoUHUSCIv.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\ProviderInto\blocksurrogate.exe
      "C:\ProviderInto\blocksurrogate.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\ProviderInto\taskhostw.exe
        
        "C:\ProviderInto\taskhostw.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\INF\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\INF\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\INF\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\ProviderInto\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\ProviderInto\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\ProviderInto\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NmoUHUSCIv.bat

Path C:\ProviderInto\NmoUHUSCIv.bat
Size 36B
SHA256 ea164f49511be36687b6c8aba7115701c6dd583f58589d948a72ea12de1c672e
MD5 f6f5d0c8f6feac0cb30c89fd1657cb64
SHA1 be50cec1500209cf68fe55f56b9dcc340546f454
SHA512 69a7947e16c893818a04887bf8b2e4a8cd22ad91ec9bfaa603c4eec99204c762d6d46493b0298520419f9818e2459ae372a8876b18f470b9138a1fb80f6ad258
MD5 SHA1 SHA512

Submit Download

bg4vLJUaDkf5tC.vbe

Path C:\ProviderInto\bg4vLJUaDkf5tC.vbe
Size 199B
SHA256 3478b04d7b9a3accf9d74e14f39493a5802938dbc774b2946a4c810ad3ee94af
MD5 7f1bd72e83931ae16e0939d3dbc24d5b
SHA1 8e4ebd32d84a2e9e415c86b82332cf467e8ff1ab
SHA512 d22cad0ce50bfd7fd81c9b067d8388765f51d3fbe406e9008cce04fd0863e591781f26b6259a4b5c528ece7696f7ce3997720961582143ec5627306cce48c57c
MD5 SHA1 SHA512

Submit Download

blocksurrogate.exe

Path C:\ProviderInto\blocksurrogate.exe
Size 1.3MB
SHA256 9de7ec4d1da007ad17d08ae860b474fec5ab46dd834584ba9fb36ff8a00b52f0
MD5 7ca99a0ca6db34fcfa842e5f6c203c94
SHA1 cf1a8e002cdd663e810281ff2b9093ddfa9527d0
SHA512 17ae7000770c2f2e7918fad9e202c033bcf3c92490ca04f955142abe164b0583ac22a3659f4dc120643df8c51a9d11b832071dfe66fe2032d6d778d3d4b53a33
SSDEEP 24576:RmpK3Xgjh1gMTVn/8E6Oqi4yEBCknTXCZ/UzGGq1lM/XP2YFnCZ2XKdf1et:0pKM+sHWyGXvAIbFCZ2XC1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4372-15-0x000000001BC80000-0x000000001BCD0000-memory.dmp

Download

memory/4372-13-0x0000000000950000-0x0000000000AAC000-memory.dmp

Download

memory/4372-14-0x0000000002B90000-0x0000000002BAC000-memory.dmp

Download

memory/4372-12-0x00007FFFD3593000-0x00007FFFD3595000-memory.dmp

Download

memory/4372-16-0x0000000002BB0000-0x0000000002BC6000-memory.dmp

Download

memory/4372-17-0x0000000001380000-0x0000000001392000-memory.dmp

Download

memory/4372-18-0x000000001C330000-0x000000001C858000-memory.dmp

Download

memory/4372-19-0x000000001BC30000-0x000000001BC3E000-memory.dmp

Download

memory/4372-20-0x000000001BC40000-0x000000001BC4C000-memory.dmp

Download

memory/4592-36-0x0000000002640000-0x0000000002652000-memory.dmp

Download