dcrat | 2b538dc6440e6c798ee4870f67c9d2c86efa6451ebc6669131b92bf10d31f075

General

Target
025609529f72ef4afdac5c60ee7c6b80N.exe
Size 828KB
Sample240706-ln6fesxbkf
SHA256 2b538dc6440e6c798ee4870f67c9d2c86efa6451ebc6669131b92bf10d31f075
MD5 025609529f72ef4afdac5c60ee7c6b80
SHA1 0db357ded3ba036e47c6fdc490d0ffd3f5355d6f
SHA512 16a609880c78083fd7dcfed411768dab796295645c236f313122fd1966afe152cf828cdd75dc0fd91791a9b1efddab72a9f3594f4a5f3d64bf9c14e2348e9efb
SSDEEP 12288:2JRAMWJAtFnYAOBn7cnIecY+in4w81PNibeeqyN9oE:uWJAtFXUecbJ6e49D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	4524	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	4524	schtasks.exe	92

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2840-1-0x00000000001B0000-0x0000000000286000-memory.dmp	dcrat
behavioral2/files/0x00070000000236a9-11.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	025609529f72ef4afdac5c60ee7c6b80N.exe

Executes dropped EXE 1 IoCs

pid	Process
3480	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	pastebin.com
17	pastebin.com

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\msedge.exe	025609529f72ef4afdac5c60ee7c6b80N.exe
File created	C:\Program Files\Java\jre-1.8\61a52ddc9dd915	025609529f72ef4afdac5c60ee7c6b80N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\5940a34987c991	025609529f72ef4afdac5c60ee7c6b80N.exe
File created	C:\Program Files\dotnet\shared\wininit.exe	025609529f72ef4afdac5c60ee7c6b80N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\c5b4cb5e9653cc	025609529f72ef4afdac5c60ee7c6b80N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\msedge.exe	025609529f72ef4afdac5c60ee7c6b80N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe	025609529f72ef4afdac5c60ee7c6b80N.exe
File created	C:\Program Files\dotnet\shared\56085415360792	025609529f72ef4afdac5c60ee7c6b80N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\services.exe	025609529f72ef4afdac5c60ee7c6b80N.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\ja-JP\886983d96e3d3e	025609529f72ef4afdac5c60ee7c6b80N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..agnostics.resources_31bf3856ad364e35_10.0.19041.1_el-gr_e2ae026950602285\dwm.exe	025609529f72ef4afdac5c60ee7c6b80N.exe
File created	C:\Windows\ja-JP\csrss.exe	025609529f72ef4afdac5c60ee7c6b80N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	025609529f72ef4afdac5c60ee7c6b80N.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1340	schtasks.exe
928	schtasks.exe
2832	schtasks.exe
1676	schtasks.exe
2040	schtasks.exe
1068	schtasks.exe
1036	schtasks.exe
1680	schtasks.exe
4644	schtasks.exe
3264	schtasks.exe
4604	schtasks.exe
1660	schtasks.exe
4664	schtasks.exe
1544	schtasks.exe
1932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2840	025609529f72ef4afdac5c60ee7c6b80N.exe
2840	025609529f72ef4afdac5c60ee7c6b80N.exe
2840	025609529f72ef4afdac5c60ee7c6b80N.exe
3480	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	025609529f72ef4afdac5c60ee7c6b80N.exe
Token: SeDebugPrivilege	3480	csrss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3092	2840	025609529f72ef4afdac5c60ee7c6b80N.exe	108
PID 2840 wrote to memory of 3092	2840	025609529f72ef4afdac5c60ee7c6b80N.exe	108
PID 3092 wrote to memory of 4364	3092	cmd.exe	110
PID 3092 wrote to memory of 4364	3092	cmd.exe	110
PID 3092 wrote to memory of 3480	3092	cmd.exe	112
PID 3092 wrote to memory of 3480	3092	cmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\025609529f72ef4afdac5c60ee7c6b80N.exe
"C:\Users\Admin\AppData\Local\Temp\025609529f72ef4afdac5c60ee7c6b80N.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\umbpYzQFfW.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4364
- - C:\Windows\ja-JP\csrss.exe
    "C:\Windows\ja-JP\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre-1.8\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre-1.8\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\shared\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\shared\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,18101465343131957040,13619216624229484913,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\Program Files\Mozilla Firefox\defaults\pref\services.exe
Size 828KB
SHA256 2b538dc6440e6c798ee4870f67c9d2c86efa6451ebc6669131b92bf10d31f075
MD5 025609529f72ef4afdac5c60ee7c6b80
SHA1 0db357ded3ba036e47c6fdc490d0ffd3f5355d6f
SHA512 16a609880c78083fd7dcfed411768dab796295645c236f313122fd1966afe152cf828cdd75dc0fd91791a9b1efddab72a9f3594f4a5f3d64bf9c14e2348e9efb
SSDEEP 12288:2JRAMWJAtFnYAOBn7cnIecY+in4w81PNibeeqyN9oE:uWJAtFXUecbJ6e49D
MD5 SHA1 SHA512 SSDEEP

Submit Download

umbpYzQFfW.bat

Path C:\Users\Admin\AppData\Local\Temp\umbpYzQFfW.bat
Size 191B
SHA256 193d8d0a3afe9967eaba1f621aca8adcf04f4c2493a532ea6c8704dd71c3d221
MD5 5115b9a05b101b1a396aaf0d7e162ca0
SHA1 acd37ef8d8ecdde9e4bee32433019b5c5d456c10
SHA512 ca31692688c7efaf5da0ac35b94ab1639e0e3a92a2f10f8688c8c7f5a2fe66256b92fc85fa71a873d8c7d5183d2a2ecc9002c28634774d3601b96eaba1782b0b
MD5 SHA1 SHA512

Submit Download

memory/2840-0-0x00007FFC86D53000-0x00007FFC86D55000-memory.dmp

Download

memory/2840-1-0x00000000001B0000-0x0000000000286000-memory.dmp

Download

memory/2840-2-0x00007FFC86D50000-0x00007FFC87811000-memory.dmp

Download

memory/2840-18-0x00007FFC86D50000-0x00007FFC87811000-memory.dmp

Download

memory/3480-24-0x000000001D600000-0x000000001D702000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads