dcrat | f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd

Analysis

max time kernel
125s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e9a88aba7de675e6d7d385cfba393e9.exe
Size 1.5MB
Sample240705-qsd9ys1gra
SHA256 f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd
MD5 1e9a88aba7de675e6d7d385cfba393e9
SHA1 891b6ae195a1b10fdeb94474d0c174671501a164
SHA512 2e2a8ea45085a2d9069ffb330a14879f8554bb52a04f9cb36a43dac5344ca410bee32e792576c3b7cd0835af0c43c2bbeb71543eb3c73ce9a8228fd49891464f
SSDEEP 24576:U2G/nvxW3Ww0tWT0hI40WPkGHSaGQhY9sb0jKKO4YNlSMjiz:UbA30WT6fM+b0jjGNDI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2264	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2264	schtasks.exe	96

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0008000000023582-10.dat	dcrat
behavioral2/memory/344-13-0x0000000000E30000-0x0000000000F62000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	1e9a88aba7de675e6d7d385cfba393e9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	msserverreview.exe

Executes dropped EXE 2 IoCs

pid	Process
344	msserverreview.exe
540	SearchApp.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\SearchApp.exe	msserverreview.exe
File created	C:\Program Files (x86)\Google\Temp\38384e6a620884	msserverreview.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe	msserverreview.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\886983d96e3d3e	msserverreview.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\msedge.exe	msserverreview.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\61a52ddc9dd915	msserverreview.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Logs\Telephony\fontdrvhost.exe	msserverreview.exe
File created	C:\Windows\Logs\Telephony\5b884080fd4f94	msserverreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	1e9a88aba7de675e6d7d385cfba393e9.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
412	schtasks.exe
812	schtasks.exe
3580	schtasks.exe
1040	schtasks.exe
2232	schtasks.exe
536	schtasks.exe
3524	schtasks.exe
632	schtasks.exe
4012	schtasks.exe
3152	schtasks.exe
32	schtasks.exe
1092	schtasks.exe
1596	schtasks.exe
2788	schtasks.exe
2856	schtasks.exe
3564	schtasks.exe
2340	schtasks.exe
4584	schtasks.exe
3068	schtasks.exe
4056	schtasks.exe
3492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
344	msserverreview.exe
344	msserverreview.exe
344	msserverreview.exe
540	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	344	msserverreview.exe
Token: SeDebugPrivilege	540	SearchApp.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1364	640	1e9a88aba7de675e6d7d385cfba393e9.exe	91
PID 640 wrote to memory of 1364	640	1e9a88aba7de675e6d7d385cfba393e9.exe	91
PID 640 wrote to memory of 1364	640	1e9a88aba7de675e6d7d385cfba393e9.exe	91
PID 1364 wrote to memory of 3920	1364	WScript.exe	92
PID 1364 wrote to memory of 3920	1364	WScript.exe	92
PID 1364 wrote to memory of 3920	1364	WScript.exe	92
PID 3920 wrote to memory of 344	3920	cmd.exe	94
PID 3920 wrote to memory of 344	3920	cmd.exe	94
PID 344 wrote to memory of 540	344	msserverreview.exe	118
PID 344 wrote to memory of 540	344	msserverreview.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1e9a88aba7de675e6d7d385cfba393e9.exe
"C:\Users\Admin\AppData\Local\Temp\1e9a88aba7de675e6d7d385cfba393e9.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BridgeproviderComponentWeb\CMsHZr.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BridgeproviderComponentWeb\nWoDGncQ9swsrnWdh.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\BridgeproviderComponentWeb\msserverreview.exe
      "C:\BridgeproviderComponentWeb\msserverreview.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:344
    - - C:\Program Files (x86)\Google\Temp\SearchApp.exe
        
        "C:\Program Files (x86)\Google\Temp\SearchApp.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,7362247189940554640,1583793531684159627,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:8
1⤵
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\All Users\Templates\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Templates\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\Logs\Telephony\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Logs\Telephony\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Logs\Telephony\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Temp\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Temp\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CMsHZr.vbe

Path C:\BridgeproviderComponentWeb\CMsHZr.vbe
Size 220B
SHA256 d847438f00c73870c460d5509f79b8399766605f444d0c47ff83de789f8612d5
MD5 04c75c67c7b85bd5a73747abc7ac51b3
SHA1 318ed3c6066385775a6c9fd259464bcc043ed8f3
SHA512 069d9bf8309a89df5b8e54a2acc2b03820426e0cf0046be01473f6697cc6ff8e7081b69cb3ce3402fbd3234a920302ddbfd1be0553c04e663fbe04207fd099c6
MD5 SHA1 SHA512

Submit Download

msserverreview.exe

Path C:\BridgeproviderComponentWeb\msserverreview.exe
Size 1.2MB
SHA256 aae27dbee53b9aacb4bf21b9349fe6be453f2020425759f6f3fc85a0058215d1
MD5 f290d1e8b836ffb7a71cbdd5d38b8ad5
SHA1 34080d3c82cb3cd3d5b7bf4ceea2f69722a58598
SHA512 73af5b54a2809780c7b05096c567de10436550a47e9ab4a13a3952e13b963e5508d81f88461dcc628178a8e941fca622b8f0f4382472a5e259f43586ea20ca71
SSDEEP 24576:zT0hI40WPkGHSaGQhY9sb0jKKO4YNlSMji:zT6fM+b0jjGND
MD5 SHA1 SHA512 SSDEEP

Submit Download

nWoDGncQ9swsrnWdh.bat

Path C:\BridgeproviderComponentWeb\nWoDGncQ9swsrnWdh.bat
Size 50B
SHA256 16495af781bf0d6a02ee71d6c59ac8398ba2bc916851236f949ed6451e561876
MD5 2670f34f0133c3d71440528a96e0e650
SHA1 f1df1b26489f870bda982fab884ac8b531937c7e
SHA512 26af6d086397ff57a0e49aec3616364de4514b2988f42194af69984d4a74cb5b996f0d9d24b442ba8090827f5bba3877c154e423526b1ec7864a1bbbc65b7234
MD5 SHA1 SHA512

Submit Download

memory/344-12-0x00007FFB6F693000-0x00007FFB6F695000-memory.dmp

Download

memory/344-13-0x0000000000E30000-0x0000000000F62000-memory.dmp

Download

memory/344-14-0x00000000017A0000-0x00000000017BC000-memory.dmp

Download

memory/344-16-0x00000000031B0000-0x00000000031C6000-memory.dmp

Download

memory/344-15-0x000000001BAF0000-0x000000001BB40000-memory.dmp

Download

memory/344-17-0x0000000001780000-0x000000000178C000-memory.dmp

Download