dcrat | 3a45f3eeb50019496878de2b1042b27fdf54edfa6082ebe290d9c47a26347725

Resubmissions

06/07/2024, 16:11

240706-tnbj2sthpp10

06/07/2024, 16:09

240706-tl3whsthll10

Analysis

max time kernel
133s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06/07/2024, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SolaraB.exe
Size 1.4MB
Sample240706-tnbj2sthpp
SHA256 3a45f3eeb50019496878de2b1042b27fdf54edfa6082ebe290d9c47a26347725
MD5 233417cb2548f3bbf0abbff8c8d08e18
SHA1 292b8b8f18826c152ca73006d194c401872cd8bf
SHA512 389b7aa535a1d4f05ed5f12a3447d6c418e223dd10ea566d8b7a2c70d88783cf60986d59741693cdb2e0af0f398a9a82880165d4efae35673e74eeb83ba8a36e
SSDEEP 24576:U2G/nvxW3Ww0t718Zausjp9ljrvilDg5I+HzYOdmXOcVRMF+aKfR:UbA30718Z9Mlj5NCOuR0+aKZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000800000001ac4e-11.dat	dcrat
behavioral2/memory/3408-14-0x0000000000E80000-0x0000000000F98000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3408	ChainSaves.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	SolaraB.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3408	ChainSaves.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4116	3336	SolaraB.exe	73
PID 3336 wrote to memory of 4116	3336	SolaraB.exe	73
PID 3336 wrote to memory of 4116	3336	SolaraB.exe	73
PID 4116 wrote to memory of 164	4116	WScript.exe	74
PID 4116 wrote to memory of 164	4116	WScript.exe	74
PID 4116 wrote to memory of 164	4116	WScript.exe	74
PID 164 wrote to memory of 3408	164	cmd.exe	76
PID 164 wrote to memory of 3408	164	cmd.exe	76

C:\Users\Admin\AppData\Local\Temp\SolaraB.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\XBpQY6nWDp4AaY28vBSA0n.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\zCYeYR.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:164
  - - C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\ChainSaves.exe
      "C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\ChainSaves.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChainSaves.exe

Path C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\ChainSaves.exe
Size 1.1MB
SHA256 ce2f6663db730c37fd4cde0983634510fdd31fb973b8f7633bf52371a3b6fdba
MD5 722b34329c4311c9555c41682a550c06
SHA1 608d66528ecd520233747a14dd3cdfd6998fce71
SHA512 03f63da492ceaf277f9005a7a48afbce53f2a3f1c4f5a6e4e38de0ebaae641ada094ff849a7a73a4af0aea8073f21ba1f6fdfdc7114305f240e0f75daa7a4d72
SSDEEP 24576:418Zausjp9ljrvilDg5I+HzYOdmXOcVRMF+aKf:418Z9Mlj5NCOuR0+aK
MD5 SHA1 SHA512 SSDEEP

Submit Download

XBpQY6nWDp4AaY28vBSA0n.vbe

Path C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\XBpQY6nWDp4AaY28vBSA0n.vbe
Size 200B
SHA256 0e4b4c14e9647e964fc34a7237f27492460b9fbb3c1956318d5ba6c896285eb5
MD5 a321b06db2f679f3f0151e3abc80c43c
SHA1 1302ed20298f80724df11053e54854d47e35d143
SHA512 a3c8786ae75e6f49ec723f10348d89cad8f80fc401519b750c06c768d55f35fe5a7c9e6e1c86bfb3e85075484dd1abb0d527bbcce636bf89ad5ff874f433062d
MD5 SHA1 SHA512

Submit Download

zCYeYR.bat

Path C:\Users\Admin\AppData\Local\Temp\browserrefCrtsvc\zCYeYR.bat
Size 40B
SHA256 3b76b5aa6ef4298fcaea871bb9b88ed5f5ecd0cda2ada2b3090a80093f1cbec3
MD5 841307750510e536ecc5f7bcc2dc04c5
SHA1 23f78f1f5e21f8a9222245587ff1a0e7f49c1905
SHA512 7fed4e9330a13730941c396ebdda4190c92cda5709c4c525f9528490ba1d76a5fa34898effa7b160ecb8d954a168e2a31ced2f534510621eea4b65386968af6b
MD5 SHA1 SHA512

Submit Download

memory/3408-14-0x0000000000E80000-0x0000000000F98000-memory.dmp

Download

memory/3408-15-0x0000000003000000-0x000000000300E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads