dcrat | 796cd73427bc05a3c067f276205680eae57b1ec7aaeed214d4d375481a7c5b56

General

Target
Neverlose.exe
Size 2.9MB
Sample240613-te38psvgrf
SHA256 796cd73427bc05a3c067f276205680eae57b1ec7aaeed214d4d375481a7c5b56
MD5 4eb9a1cb4a372c7878ac96bea631dfdb
SHA1 c4f5ae22d023d646d7f29a3f12a21de98f462d42
SHA512 6087bff01bd7bdab121f2653d6e09e091cd822e6c5bb8d3e6f8ae5525900efdd3c054d56b57295e4057a875868c189137bfb7318653d365bc234994c53daf344
SSDEEP 49152:9bA3YXDnu1/9uyj/ZkPxIjS1in7dTpP0M2dZoUmvT4sJiyneC2Yww+:9bDnu1/WIjj7ZyVaUmv0OiEeC2YwT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002354f-15.dat	dcrat
behavioral2/memory/2292-17-0x0000000000D10000-0x0000000000F90000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Neverlose.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2292	cmd.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System\conhost	Neverlose.exe
File created	C:\Windows\System\conhost\file.vbs	Neverlose.exe
File opened for modification	C:\Windows\System\conhost\2IIvNRvKGg.bat	Neverlose.exe
File created	C:\Windows\System\conhost\4eI0td7Dh0msFGfIRu8AHy1.vbe	Neverlose.exe
File opened for modification	C:\Windows\System\conhost\cmd.exe	Neverlose.exe
File opened for modification	C:\Windows\System\conhost\4eI0td7Dh0msFGfIRu8AHy1.vbe	Neverlose.exe
File created	C:\Windows\System\conhost\__tmp_rar_sfx_access_check_240641953	Neverlose.exe
File opened for modification	C:\Windows\System\conhost\file.vbs	Neverlose.exe
File created	C:\Windows\System\conhost\2IIvNRvKGg.bat	Neverlose.exe
File created	C:\Windows\System\conhost\cmd.exe	Neverlose.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	Neverlose.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	cmd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 3708	1012	Neverlose.exe	90
PID 1012 wrote to memory of 3708	1012	Neverlose.exe	90
PID 1012 wrote to memory of 3708	1012	Neverlose.exe	90
PID 1012 wrote to memory of 2012	1012	Neverlose.exe	91
PID 1012 wrote to memory of 2012	1012	Neverlose.exe	91
PID 1012 wrote to memory of 2012	1012	Neverlose.exe	91
PID 3708 wrote to memory of 436	3708	WScript.exe	95
PID 3708 wrote to memory of 436	3708	WScript.exe	95
PID 3708 wrote to memory of 436	3708	WScript.exe	95
PID 436 wrote to memory of 2292	436	cmd.exe	97
PID 436 wrote to memory of 2292	436	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\Neverlose.exe
"C:\Users\Admin\AppData\Local\Temp\Neverlose.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\System\conhost\4eI0td7Dh0msFGfIRu8AHy1.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\System\conhost\2IIvNRvKGg.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\System\conhost\cmd.exe
      "C:\Windows\System\conhost\cmd.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2292
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\System\conhost\file.vbs"
  2⤵
  PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2IIvNRvKGg.bat

Path C:\Windows\System\conhost\2IIvNRvKGg.bat
Size 35B
SHA256 1ef585cebf036878a87e02ea3785a303e62f4dba2b918c23f33cf339fb6a1052
MD5 82b0bdb485fdc6e60f2ce1bbc87a47e5
SHA1 7bf2021ea925014936a5fb1d0d554d47b0a32539
SHA512 dacb6a4c7b4dd28d5654ae19a588293e125e9c4f46ab6c635f593a1db5ab20f62438fc2d9af60c817ac90ebfc91861b3136fb93e3cf562b83b874e258cee723c
MD5 SHA1 SHA512

Submit Download

4eI0td7Dh0msFGfIRu8AHy1.vbe

Path C:\Windows\System\conhost\4eI0td7Dh0msFGfIRu8AHy1.vbe
Size 209B
SHA256 9a6575c85308d815b714456c4c547a7ae5dbdeba3c90695edac2c921a246adab
MD5 9d00deae42972c223c06bf0fce7ba36a
SHA1 e780b5f2b0102465f63d0226ab54d9b4f0f5b1a7
SHA512 8166e234bcdf528e9ccc6e1f37d7c9182887cd01e1eb811ea8b5eaba7722f815b0207ec7ce8a9e0bc34284ac7d0a379f5488977b58814b70bc70daa36d40a4e7
MD5 SHA1 SHA512

Submit Download

cmd.exe

Path C:\Windows\System\conhost\cmd.exe
Size 2.5MB
SHA256 2e4eda84ba31bd1a4599220fa2a650e4b5f0d474c3b0bc3d6fdc2d864fd65a6f
MD5 026512f032173545c2a329752b4e1e04
SHA1 13efd3a4fb070ae8f72a0149e695d5063e9d5e4f
SHA512 d6734feec4bd4fa4758031a8bd617c23d834ffde93a63bc1f5f5b3481bb60078d5e191e599adedf93f9f143bd8f746929c03d628b8a29bb18490defabfea417a
SSDEEP 49152:DDnu1/9uyj/ZkPxIjS1in7dTpP0M2dZoUmvT4sJiyneC2Yww:/nu1/WIjj7ZyVaUmv0OiEeC2Yw
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.vbs

Path C:\Windows\System\conhost\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

memory/2292-17-0x0000000000D10000-0x0000000000F90000-memory.dmp

Download

memory/2292-18-0x000000001BB80000-0x000000001BB8E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads