dcrat | c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e

General

Target
malware.exe
Size 1.9MB
Sample240703-e5b5ks1fqp
SHA256 c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e
MD5 4825e7df93d8acb3dd236cc14c342a71
SHA1 5cc72cdde2d55a8c5e01ccd80cbb5743bc60ca1b
SHA512 a2e8aa90a719cdddb2f9a4fb21b43f6471cb06e0cb94bd041f26b6a4e11bd820a04c5ea832bb899a91db73d7114b046834afe788d6c03d71b1bf6697272de591
SSDEEP 24576:Ware5SMXhd8zlKNfn6LQrmq4Ku0a7ttoXJZ4pt+NfCgPc52L6cnPmJ9C7CnzpCrk:WvgTW0uNmJPCrjTpM5B3L/q0vlU426n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
behavioral2/memory/1576-21-0x0000000000400000-0x0000000000456000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	malware.exe

Executes dropped EXE 1 IoCs

pid	Process
5092	DllHelper.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 1576	5092	DllHelper.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4568	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1884	1256	malware.exe	94
PID 1256 wrote to memory of 1884	1256	malware.exe	94
PID 1256 wrote to memory of 1884	1256	malware.exe	94
PID 1256 wrote to memory of 5092	1256	malware.exe	96
PID 1256 wrote to memory of 5092	1256	malware.exe	96
PID 1256 wrote to memory of 5092	1256	malware.exe	96
PID 1256 wrote to memory of 2736	1256	malware.exe	99
PID 1256 wrote to memory of 2736	1256	malware.exe	99
PID 1256 wrote to memory of 2736	1256	malware.exe	99
PID 2736 wrote to memory of 4648	2736	cmd.exe	101
PID 2736 wrote to memory of 4648	2736	cmd.exe	101
PID 2736 wrote to memory of 4648	2736	cmd.exe	101
PID 2736 wrote to memory of 4568	2736	cmd.exe	102
PID 2736 wrote to memory of 4568	2736	cmd.exe	102
PID 2736 wrote to memory of 4568	2736	cmd.exe	102
PID 5092 wrote to memory of 1576	5092	DllHelper.exe	103
PID 5092 wrote to memory of 1576	5092	DllHelper.exe	103
PID 5092 wrote to memory of 1576	5092	DllHelper.exe	103
PID 5092 wrote to memory of 1576	5092	DllHelper.exe	103
PID 5092 wrote to memory of 1576	5092	DllHelper.exe	103

C:\Users\Admin\AppData\Local\Temp\malware.exe
"C:\Users\Admin\AppData\Local\Temp\malware.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\AppVerif\DllHelper.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1884
- C:\Users\Admin\AppVerif\DllHelper.exe
  "C:\Users\Admin\AppVerif\DllHelper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\malware.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4568