dcrat | e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d11c28e9ddfd0ea910b9ae2452dccf3.exe
Size

1.1MB
MD5

4d11c28e9ddfd0ea910b9ae2452dccf3
SHA1

9c5540ed7b779477d181382dc81a0621fc930971
SHA256

e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280
SHA512

6f87a7f3607b9ae993acea64cc6b3bf2c6b593b2e1ecf9e35b187d39245d43812d46382f75fde0e26ea535e8fdca1b912c46393e33cd1571fd2c4556466b6938
SSDEEP

24576:U2G/nvxW3Ww0tR6q25E1hDUNoTAicnf6z8Kt:UbA30Fvhwi80

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000233bf-10.dat	dcrat
behavioral2/memory/1396-13-0x0000000000120000-0x00000000001F6000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	4d11c28e9ddfd0ea910b9ae2452dccf3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1396	wininto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	4d11c28e9ddfd0ea910b9ae2452dccf3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1396	wininto.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1396	wininto.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 964	4184	4d11c28e9ddfd0ea910b9ae2452dccf3.exe	81
PID 4184 wrote to memory of 964	4184	4d11c28e9ddfd0ea910b9ae2452dccf3.exe	81
PID 4184 wrote to memory of 964	4184	4d11c28e9ddfd0ea910b9ae2452dccf3.exe	81
PID 964 wrote to memory of 1552	964	WScript.exe	85
PID 964 wrote to memory of 1552	964	WScript.exe	85
PID 964 wrote to memory of 1552	964	WScript.exe	85
PID 1552 wrote to memory of 1396	1552	cmd.exe	87
PID 1552 wrote to memory of 1396	1552	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\4d11c28e9ddfd0ea910b9ae2452dccf3.exe
"C:\Users\Admin\AppData\Local\Temp\4d11c28e9ddfd0ea910b9ae2452dccf3.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\k2wxG4uaUkBbG1HJ4EpeboBys6oty.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\Su7beFRaWTg0xRHyqfA5bDL.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\wininto.exe
      "C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\wininto.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\Su7beFRaWTg0xRHyqfA5bDL.bat

Filesize
48B

MD5
8fd441a13337120576d6c5efe9dd4a27

SHA1
001877207e0ad44d0dd057fbe94232eb9366cfe7

SHA256
1d9ed55be6ca5c24ed4573a61a1a25f2ce691cab09947ea7e6402726c7ec80c6

SHA512
ce5b5aba22a7cf988553c418874c022cd4f3d2a357f6b3907e99b5246b2d9164b892577c56e04f546febc14bcbbd8ce8a44c9521e47cf5afca78c0086af5f38b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\k2wxG4uaUkBbG1HJ4EpeboBys6oty.vbe

Filesize
231B

MD5
2da320e60abaee9776c04c95d14360f8

SHA1
d242565c64b2a488384813667a858a46d72c6a98

SHA256
28324e5aaa8f0615c3050a11487aebe05b2117d72bfa46b89d364990e1be2d10

SHA512
af3032e01bef2ed8a394051ebe5894a15f982bfe9d8d15da18804bd69a3eda1d343a62d01a358f6b5ad3ac476a8bb6cfa9c2ed5d900ae13719b398fab4f68c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\wininto.exe

Filesize
826KB

MD5
c328a904a74492b29befb48f3dbed741

SHA1
7b3a39faae592c3e5a1d989ff9f0f06ce20cfcf7

SHA256
0657ce3a271804cdb705c6f51ef64c8eab365d4fd040c402a6e2c2b94e4c638b

SHA512
5479bb2a4d26347ad4d46ecbf326f6c004c438c23074a1c6a9761cf67778bad29a820ff614e4653ec7fedd0025c93856b99a69850d552fff994ee6c5bd1e6e19

Download Submit
memory/1396-12-0x00007FFD08A13000-0x00007FFD08A15000-memory.dmp

Filesize
8KB

Download
memory/1396-13-0x0000000000120000-0x00000000001F6000-memory.dmp

Filesize
856KB

Download