dcrat | 1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64

General

Target
1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
Size 1001KB
Sample240617-tm2d3swajc
SHA256 1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64
MD5 3146f2002112e5ba7562a28ff1883f9a
SHA1 9bd64b0954d746395e8080e563dbb39b254fac7d
SHA512 08e1e8c002269a4d611d21de3d037879abcbbf59f8f3744f27ee62b296adf61664f4f7afe0dc36bcdd4b5070fe6b7bf146ff94b0c682fee09e61bfa0935c3cfa
SSDEEP 12288:BiqbUK9S2Jhb/PZWzR6keiZAHOVEAKNZCKTh3VnGFOeRJmuHwj3x:hUK9SePZWzYrLHOdKRTh3heRJXQjx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2424	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2424	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/116-0-0x0000000000A70000-0x0000000000B72000-memory.dmp	dcrat
behavioral2/files/0x000700000002360a-13.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe

Executes dropped EXE 1 IoCs

pid	Process
1976	Registry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
19	pastebin.com
20	pastebin.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\Registry.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\ee2ad38f3d4382	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\fontdrvhost.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\5b884080fd4f94	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\PrintDialog\microsoft.system.package.metadata\TextInputHost.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File opened for modification	C:\Windows\PrintDialog\microsoft.system.package.metadata\TextInputHost.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Windows\PrintDialog\microsoft.system.package.metadata\22eafd247d37c3	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3636	schtasks.exe
1424	schtasks.exe
4992	schtasks.exe
640	schtasks.exe
2272	schtasks.exe
4008	schtasks.exe
1304	schtasks.exe
2724	schtasks.exe
1580	schtasks.exe
4728	schtasks.exe
3828	schtasks.exe
2948	schtasks.exe
3940	schtasks.exe
2580	schtasks.exe
412	schtasks.exe
1600	schtasks.exe
4088	schtasks.exe
3956	schtasks.exe
4644	schtasks.exe
4936	schtasks.exe
3412	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
116	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
116	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
116	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
116	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
116	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
1976	Registry.exe
1976	Registry.exe
1976	Registry.exe
1976	Registry.exe
1976	Registry.exe
1976	Registry.exe
1976	Registry.exe
1976	Registry.exe
1976	Registry.exe
1976	Registry.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	Registry.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
Token: SeDebugPrivilege	1976	Registry.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 2348	116	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe	113
PID 116 wrote to memory of 2348	116	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe	113
PID 2348 wrote to memory of 2260	2348	cmd.exe	115
PID 2348 wrote to memory of 2260	2348	cmd.exe	115
PID 2348 wrote to memory of 1976	2348	cmd.exe	121
PID 2348 wrote to memory of 1976	2348	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
"C:\Users\Admin\AppData\Local\Temp\1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\576PQzxnsO.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2260
- - C:\Program Files (x86)\Windows NT\TableTextService\Registry.exe
    "C:\Program Files (x86)\Windows NT\TableTextService\Registry.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\PrintHood\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\PrintHood\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1300,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

576PQzxnsO.bat

Path C:\Users\Admin\AppData\Local\Temp\576PQzxnsO.bat
Size 228B
SHA256 4ac48e9f852af7655aa46f4ecb3637bda8c0145ddcffbd8c469ccf87e5d31624
MD5 1a7b78796bcd72e6b5f412b5f4d540c3
SHA1 0b8d1bb190de0ca4454fab15aecb023e95555b72
SHA512 28a6a9d36b949a375dfa2847604698628765ce41def1da5433ecdafb53db8d20f84dcf37db1741b37039d04b6e6d91285c56f2d8599e295bec6f184bcba41962
MD5 SHA1 SHA512

Submit Download

SppExtComObj.exe

Path C:\Users\Default\SppExtComObj.exe
Size 1001KB
SHA256 1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64
MD5 3146f2002112e5ba7562a28ff1883f9a
SHA1 9bd64b0954d746395e8080e563dbb39b254fac7d
SHA512 08e1e8c002269a4d611d21de3d037879abcbbf59f8f3744f27ee62b296adf61664f4f7afe0dc36bcdd4b5070fe6b7bf146ff94b0c682fee09e61bfa0935c3cfa
SSDEEP 12288:BiqbUK9S2Jhb/PZWzR6keiZAHOVEAKNZCKTh3VnGFOeRJmuHwj3x:hUK9SePZWzYrLHOdKRTh3heRJXQjx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-1-0x00007FFCC2FB3000-0x00007FFCC2FB5000-memory.dmp

Download

memory/116-0-0x0000000000A70000-0x0000000000B72000-memory.dmp

Download

memory/116-3-0x00007FFCC2FB0000-0x00007FFCC3A71000-memory.dmp

Download

memory/116-2-0x0000000002D00000-0x0000000002D1C000-memory.dmp

Download

memory/116-4-0x000000001B700000-0x000000001B750000-memory.dmp

Download

memory/116-24-0x00007FFCC2FB0000-0x00007FFCC3A71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads