dcrat | e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280

General

Target
e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280.exe
Size 1.1MB
Sample240612-cxe56ayfqd
SHA256 e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280
MD5 4d11c28e9ddfd0ea910b9ae2452dccf3
SHA1 9c5540ed7b779477d181382dc81a0621fc930971
SHA512 6f87a7f3607b9ae993acea64cc6b3bf2c6b593b2e1ecf9e35b187d39245d43812d46382f75fde0e26ea535e8fdca1b912c46393e33cd1571fd2c4556466b6938
SSDEEP 24576:U2G/nvxW3Ww0tR6q25E1hDUNoTAicnf6z8Kt:UbA30Fvhwi80
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000235df-10.dat	dcrat
behavioral2/memory/4844-13-0x0000000000780000-0x0000000000856000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	wininto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4844	wininto.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	wininto.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 212	2040	e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280.exe	90
PID 2040 wrote to memory of 212	2040	e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280.exe	90
PID 2040 wrote to memory of 212	2040	e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280.exe	90
PID 212 wrote to memory of 3144	212	WScript.exe	95
PID 212 wrote to memory of 3144	212	WScript.exe	95
PID 212 wrote to memory of 3144	212	WScript.exe	95
PID 3144 wrote to memory of 4844	3144	cmd.exe	97
PID 3144 wrote to memory of 4844	3144	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280.exe
"C:\Users\Admin\AppData\Local\Temp\e5b3c145f4e3762e70e31a7a1b662f6711d8ca6b760cb8e166f6f9014c4b4280.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\k2wxG4uaUkBbG1HJ4EpeboBys6oty.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\Su7beFRaWTg0xRHyqfA5bDL.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\wininto.exe
      "C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\wininto.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4216,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Su7beFRaWTg0xRHyqfA5bDL.bat

Path C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\Su7beFRaWTg0xRHyqfA5bDL.bat
Size 48B
SHA256 1d9ed55be6ca5c24ed4573a61a1a25f2ce691cab09947ea7e6402726c7ec80c6
MD5 8fd441a13337120576d6c5efe9dd4a27
SHA1 001877207e0ad44d0dd057fbe94232eb9366cfe7
SHA512 ce5b5aba22a7cf988553c418874c022cd4f3d2a357f6b3907e99b5246b2d9164b892577c56e04f546febc14bcbbd8ce8a44c9521e47cf5afca78c0086af5f38b
MD5 SHA1 SHA512

Submit Download

k2wxG4uaUkBbG1HJ4EpeboBys6oty.vbe

Path C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\k2wxG4uaUkBbG1HJ4EpeboBys6oty.vbe
Size 231B
SHA256 28324e5aaa8f0615c3050a11487aebe05b2117d72bfa46b89d364990e1be2d10
MD5 2da320e60abaee9776c04c95d14360f8
SHA1 d242565c64b2a488384813667a858a46d72c6a98
SHA512 af3032e01bef2ed8a394051ebe5894a15f982bfe9d8d15da18804bd69a3eda1d343a62d01a358f6b5ad3ac476a8bb6cfa9c2ed5d900ae13719b398fab4f68c9b
MD5 SHA1 SHA512

Submit Download

wininto.exe

Path C:\Users\Admin\AppData\Local\Temp\Hypersurrogatefontreviewref\wininto.exe
Size 826KB
SHA256 0657ce3a271804cdb705c6f51ef64c8eab365d4fd040c402a6e2c2b94e4c638b
MD5 c328a904a74492b29befb48f3dbed741
SHA1 7b3a39faae592c3e5a1d989ff9f0f06ce20cfcf7
SHA512 5479bb2a4d26347ad4d46ecbf326f6c004c438c23074a1c6a9761cf67778bad29a820ff614e4653ec7fedd0025c93856b99a69850d552fff994ee6c5bd1e6e19
SSDEEP 12288:RpLH6wR0gqsQ5W5E1ofkDUNoTQg/Hyvzliow6rnf6z8K:q6q25E1hDUNoTAicnf6z8K
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4844-12-0x00007FFF159F3000-0x00007FFF159F5000-memory.dmp

Download

memory/4844-13-0x0000000000780000-0x0000000000856000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads