dcrat | 3a45f3eeb50019496878de2b1042b27fdf54edfa6082ebe290d9c47a26347725

Resubmissions

06/07/2024, 16:11

240706-tnbj2sthpp10

06/07/2024, 16:09

240706-tl3whsthll10

Analysis

max time kernel
114s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SolaraB.exe
Size 1.4MB
Sample240706-tl3whsthll
SHA256 3a45f3eeb50019496878de2b1042b27fdf54edfa6082ebe290d9c47a26347725
MD5 233417cb2548f3bbf0abbff8c8d08e18
SHA1 292b8b8f18826c152ca73006d194c401872cd8bf
SHA512 389b7aa535a1d4f05ed5f12a3447d6c418e223dd10ea566d8b7a2c70d88783cf60986d59741693cdb2e0af0f398a9a82880165d4efae35673e74eeb83ba8a36e
SSDEEP 24576:U2G/nvxW3Ww0t718Zausjp9ljrvilDg5I+HzYOdmXOcVRMF+aKfR:UbA30718Z9Mlj5NCOuR0+aKZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000900000002345d-10.dat	dcrat
behavioral2/memory/2012-13-0x0000000000410000-0x0000000000528000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	SolaraB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2012	ChainSaves.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings	SolaraB.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	ChainSaves.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 184	4804	SolaraB.exe	85
PID 4804 wrote to memory of 184	4804	SolaraB.exe	85
PID 4804 wrote to memory of 184	4804	SolaraB.exe	85
PID 184 wrote to memory of 4900	184	WScript.exe	86
PID 184 wrote to memory of 4900	184	WScript.exe	86
PID 184 wrote to memory of 4900	184	WScript.exe	86
PID 4900 wrote to memory of 2012	4900	cmd.exe	88
PID 4900 wrote to memory of 2012	4900	cmd.exe	88
PID 2088 wrote to memory of 1444	2088	msedge.exe	104
PID 2088 wrote to memory of 1444	2088	msedge.exe	104
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 4248	2088	msedge.exe	105
PID 2088 wrote to memory of 1468	2088	msedge.exe	106
PID 2088 wrote to memory of 1468	2088	msedge.exe	106
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107
PID 2088 wrote to memory of 4148	2088	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\SolaraB.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\XBpQY6nWDp4AaY28vBSA0n.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\zCYeYR.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\ChainSaves.exe
      "C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\ChainSaves.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5d0c0cb0hd3b2h4649h9f77h913ab22c1bef
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb640f46f8,0x7ffb640f4708,0x7ffb640f4718
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4715509898789889854,4575343528566166846,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,4715509898789889854,4575343528566166846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,4715509898789889854,4575343528566166846,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4148

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:2980

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c
MD5 2e57ec8bd99545e47a55d581964d0549
SHA1 bd7055ea7df7696298a94dedfc91136e3b530db8
SHA512 6b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2648b18daca20927e429d0a8fc8cbc6acccca6b69c04cb6b1e7e083e22015f87
MD5 8e2899a65c49feecac183df7e7763014
SHA1 65f03a2234a94b4465fd9af82e271d2f84555b6c
SHA512 8d82c9f1d286e7e74193e3c2d0f4a8d1b3271ead71e8c1b635f7b6ab1696ca26e1962a6b44b0df4abdd8a4d15bb368dc947edea62b0ebba0aadc7cf4998d6e40
SSDEEP 96:nFqK1UDcwpvWMoiVmdeHSC+5UWQyV+VDCAiEwb:nFliDcGWMXy5rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7bfcfa33dfd19ccca2a74b212360403ac61ec0269a78f41140f833a270de4217
MD5 73d36287c978c9de0071551ac0fb56dc
SHA1 95ad5ddeefb7de83d0a61a26a1de998bb15770ad
SHA512 f4feb0bce77af68edd40f6682ed1b6a0bdb4131b76032230d6940055d0ab283b8d4a32bce9b916cdac159c4c167f251bed2c3bba26d4128ab9d1689db5362a05
SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiwe2RUu854:29iIxuERzA83h09RZxYiuq4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChainSaves.exe

Path C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\ChainSaves.exe
Size 1.1MB
SHA256 ce2f6663db730c37fd4cde0983634510fdd31fb973b8f7633bf52371a3b6fdba
MD5 722b34329c4311c9555c41682a550c06
SHA1 608d66528ecd520233747a14dd3cdfd6998fce71
SHA512 03f63da492ceaf277f9005a7a48afbce53f2a3f1c4f5a6e4e38de0ebaae641ada094ff849a7a73a4af0aea8073f21ba1f6fdfdc7114305f240e0f75daa7a4d72
SSDEEP 24576:418Zausjp9ljrvilDg5I+HzYOdmXOcVRMF+aKf:418Z9Mlj5NCOuR0+aK
MD5 SHA1 SHA512 SSDEEP

Submit Download

XBpQY6nWDp4AaY28vBSA0n.vbe

Path C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\XBpQY6nWDp4AaY28vBSA0n.vbe
Size 200B
SHA256 0e4b4c14e9647e964fc34a7237f27492460b9fbb3c1956318d5ba6c896285eb5
MD5 a321b06db2f679f3f0151e3abc80c43c
SHA1 1302ed20298f80724df11053e54854d47e35d143
SHA512 a3c8786ae75e6f49ec723f10348d89cad8f80fc401519b750c06c768d55f35fe5a7c9e6e1c86bfb3e85075484dd1abb0d527bbcce636bf89ad5ff874f433062d
MD5 SHA1 SHA512

Submit Download

zCYeYR.bat

Path C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\zCYeYR.bat
Size 40B
SHA256 3b76b5aa6ef4298fcaea871bb9b88ed5f5ecd0cda2ada2b3090a80093f1cbec3
MD5 841307750510e536ecc5f7bcc2dc04c5
SHA1 23f78f1f5e21f8a9222245587ff1a0e7f49c1905
SHA512 7fed4e9330a13730941c396ebdda4190c92cda5709c4c525f9528490ba1d76a5fa34898effa7b160ecb8d954a168e2a31ced2f534510621eea4b65386968af6b
MD5 SHA1 SHA512

Submit Download

memory/2012-12-0x00007FFB63C03000-0x00007FFB63C05000-memory.dmp

Download

memory/2012-13-0x0000000000410000-0x0000000000528000-memory.dmp

Download

memory/2012-14-0x000000001B130000-0x000000001B13E000-memory.dmp

Download