dcrat | fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93

General

Target
fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
Size 827KB
Sample240629-cd19aa1glq
SHA256 fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93
MD5 0ce55de539370fb98b263adacdc9122b
SHA1 b8026e369d6f413a8ac5dedae454a3b76a0eea32
SHA512 5d9936e3f5035483017c33a1c91fc2bbc55ca7aa5e12d9830f8b8c8ae89b4558ff125ac0d6c5075a0420df771f8c561ef44df1e0dd97494face58f18c8af0ff0
SSDEEP 12288:lDovvsS4DTVWIFpHD5u6IYFN9zQDgaOUJ69y2Lbzch6LdN:pWvsS4PFpHDE6IpjOypCaG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	3724	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	3724	schtasks.exe	81

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3664-1-0x0000000000260000-0x0000000000336000-memory.dmp	dcrat
behavioral2/files/0x000700000002351c-19.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe

Executes dropped EXE 1 IoCs

pid	Process
5040	winlogon.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Configuration\StartMenuExperienceHost.exe	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\55b276f4edf653	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
File created	C:\Program Files (x86)\Internet Explorer\winlogon.exe	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
File created	C:\Program Files (x86)\Internet Explorer\cc11b995f2a76d	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\INF\spoolsv.exe	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
File created	C:\Windows\INF\f3b6ecef712a24	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4072	schtasks.exe
2308	schtasks.exe
4500	schtasks.exe
1248	schtasks.exe
3128	schtasks.exe
4536	schtasks.exe
4936	schtasks.exe
628	schtasks.exe
1524	schtasks.exe
2852	schtasks.exe
4560	schtasks.exe
2304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
5040	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
Token: SeDebugPrivilege	5040	winlogon.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1040	3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe	94
PID 3664 wrote to memory of 1040	3664	fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe	94
PID 1040 wrote to memory of 3836	1040	cmd.exe	96
PID 1040 wrote to memory of 3836	1040	cmd.exe	96
PID 1040 wrote to memory of 5040	1040	cmd.exe	105
PID 1040 wrote to memory of 5040	1040	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe
"C:\Users\Admin\AppData\Local\Temp\fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CfYKV45h42.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3836
- - C:\Program Files (x86)\Internet Explorer\winlogon.exe
    "C:\Program Files (x86)\Internet Explorer\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Downloads\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\INF\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\INF\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Windows\INF\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Configuration\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Configuration\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe

Path C:\Program Files (x86)\Internet Explorer\winlogon.exe
Size 827KB
SHA256 fe20286db492e192672c31c79ef6808d9e33601b4fbf4c61ad1aeab5ba3b6b93
MD5 0ce55de539370fb98b263adacdc9122b
SHA1 b8026e369d6f413a8ac5dedae454a3b76a0eea32
SHA512 5d9936e3f5035483017c33a1c91fc2bbc55ca7aa5e12d9830f8b8c8ae89b4558ff125ac0d6c5075a0420df771f8c561ef44df1e0dd97494face58f18c8af0ff0
SSDEEP 12288:lDovvsS4DTVWIFpHD5u6IYFN9zQDgaOUJ69y2Lbzch6LdN:pWvsS4PFpHDE6IpjOypCaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

CfYKV45h42.bat

Path C:\Users\Admin\AppData\Local\Temp\CfYKV45h42.bat
Size 218B
SHA256 72a518cceba988ccd57fb91c62bdbd557849834cf16fa58f0cd0f7162ed25142
MD5 1a8873d1a67f1a92c96d69324ab22dc6
SHA1 869ccf97a322bbb52bc54184412b1b5098cdd8b3
SHA512 e7ef012e8a6b5dfe0811ec6a588acd699dc824d53083d434a383cddf4424b92ba73d43b7335af6b14162986ff4b12e20c9ab6496c493567d80c1f58bc798d893
MD5 SHA1 SHA512

Submit Download

memory/3664-0-0x00007FFA20523000-0x00007FFA20525000-memory.dmp

Download

memory/3664-1-0x0000000000260000-0x0000000000336000-memory.dmp

Download

memory/3664-4-0x00007FFA20520000-0x00007FFA20FE1000-memory.dmp

Download

memory/3664-16-0x00007FFA20520000-0x00007FFA20FE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads