dcrat | 411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
Size 828KB
Sample240703-hrdm2asbpf
SHA256 411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105
MD5 88a242514e271e9f2befa0dac849aa00
SHA1 73dc1d076410f8762cdc806f718dff500febb22b
SHA512 762a191730b9439eb3a7c4fcb06942a6a9324dadc74f7b29ab93faa127e849c0f60ac741048cfaed2f90250a00766ec845f2d36aaa9f38a6f1b6e3782daaf8e8
SSDEEP 12288:w8CB/Cj5EqGVplzXaQICqpPOJrqF30fRbEsWuVIc6USQAwnfWs:qB25Eq2zqQICoGPQduecj/XfWs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	416	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	1016	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	1016	schtasks.exe	83

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/320-1-0x0000000000880000-0x0000000000956000-memory.dmp	dcrat
behavioral2/files/0x0007000000023594-11.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe

Executes dropped EXE 1 IoCs

pid	Process
3976	sysmon.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\5b884080fd4f94	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
File created	C:\Program Files (x86)\Common Files\unsecapp.exe	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
File created	C:\Program Files (x86)\Common Files\29c1c3cc0f7685	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
File created	C:\Program Files\Uninstall Information\lsass.exe	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
File opened for modification	C:\Program Files\Uninstall Information\lsass.exe	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
File created	C:\Program Files\Uninstall Information\6203df4a6bafc7	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
File created	C:\Program Files (x86)\MSBuild\fontdrvhost.exe	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4880	schtasks.exe
2396	schtasks.exe
432	schtasks.exe
2164	schtasks.exe
1520	schtasks.exe
1968	schtasks.exe
1360	schtasks.exe
2152	schtasks.exe
1748	schtasks.exe
2992	schtasks.exe
4820	schtasks.exe
2716	schtasks.exe
2580	schtasks.exe
2480	schtasks.exe
412	schtasks.exe
2172	schtasks.exe
1584	schtasks.exe
3108	schtasks.exe
1992	schtasks.exe
3928	schtasks.exe
3940	schtasks.exe
2996	schtasks.exe
2232	schtasks.exe
2420	schtasks.exe
3432	schtasks.exe
2080	schtasks.exe
416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
320	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
3976	sysmon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
Token: SeDebugPrivilege	3976	sysmon.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 3976	320	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe	111
PID 320 wrote to memory of 3976	320	411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
"C:\Users\Admin\AppData\Local\Temp\411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320
- C:\Recovery\WindowsRE\sysmon.exe
  "C:\Recovery\WindowsRE\sysmon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd1054" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd1054" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe

Path C:\Recovery\WindowsRE\411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105.exe
Size 828KB
SHA256 411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105
MD5 88a242514e271e9f2befa0dac849aa00
SHA1 73dc1d076410f8762cdc806f718dff500febb22b
SHA512 762a191730b9439eb3a7c4fcb06942a6a9324dadc74f7b29ab93faa127e849c0f60ac741048cfaed2f90250a00766ec845f2d36aaa9f38a6f1b6e3782daaf8e8
SSDEEP 12288:w8CB/Cj5EqGVplzXaQICqpPOJrqF30fRbEsWuVIc6USQAwnfWs:qB25Eq2zqQICoGPQduecj/XfWs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/320-0-0x00007FFCEEC23000-0x00007FFCEEC25000-memory.dmp

Download

memory/320-1-0x0000000000880000-0x0000000000956000-memory.dmp

Download

memory/320-4-0x00007FFCEEC20000-0x00007FFCEF6E1000-memory.dmp

Download

memory/320-32-0x00007FFCEEC20000-0x00007FFCEF6E1000-memory.dmp

Download