dcrat | 50c66cf3605ee26dae74c33756b2d2b9622d2c1610b5a002a916821729018d28

Analysis

max time kernel
1757s
max time network
1759s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ention FULL.exe
Size 6.3MB
Sample240713-pj95laserf
SHA256 50c66cf3605ee26dae74c33756b2d2b9622d2c1610b5a002a916821729018d28
MD5 94bab4f942d0960f2a86b3774ede0a14
SHA1 831745cf9ea2076c12fa34627fa3c89479e359e2
SHA512 377ea470673b033f052630417574ba9a215dfe7d875913df614f34e4f3dad5b3a01b2657fd51be92b511102a88d72c13b57a9936c08aed3c38b69411cd648382
SSDEEP 196608:w+9T+10ecTm4cXALIechnPuZoYv9dahpk:RYvcTVUe1oc9cpk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	3756	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	3756	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	3756	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	3756	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	3756	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	3756	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	3756	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	3756	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3756	schtasks.exe	91

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00090000000233f5-7.dat	dcrat
behavioral2/files/0x0007000000023453-24.dat	dcrat
behavioral2/memory/4140-26-0x0000000000A70000-0x0000000000BDA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Ention FULL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe

Executes dropped EXE 11 IoCs

pid	Process
452	NVIDIA Container.exe
4140	NVIDIA Container.exe
3872	SppExtComObj.exe
2024	SppExtComObj.exe
4544	NVIDIA Container.exe
3236	RuntimeBroker.exe
1632	SppExtComObj.exe
1840	NVIDIA Container.exe
1560	RuntimeBroker.exe
5108	SppExtComObj.exe
1136	NVIDIA Container.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\35158c38368e73	NVIDIA Container.exe
File created	C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe	NVIDIA Container.exe
File created	C:\Program Files\Internet Explorer\it-IT\e1ef82546f0b02	NVIDIA Container.exe
File created	C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Reference Assemblies\9e8d7a4ca61bd9	NVIDIA Container.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe	NVIDIA Container.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	NVIDIA Container.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1076	schtasks.exe
2368	schtasks.exe
1560	schtasks.exe
5068	schtasks.exe
620	schtasks.exe
2760	schtasks.exe
4296	schtasks.exe
2632	schtasks.exe
4704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
4140	NVIDIA Container.exe
3872	SppExtComObj.exe
2024	SppExtComObj.exe
4544	NVIDIA Container.exe
3236	RuntimeBroker.exe
1632	SppExtComObj.exe
1840	NVIDIA Container.exe
1560	RuntimeBroker.exe
5108	SppExtComObj.exe
1136	NVIDIA Container.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	NVIDIA Container.exe
Token: SeDebugPrivilege	3872	SppExtComObj.exe
Token: SeDebugPrivilege	2024	SppExtComObj.exe
Token: SeDebugPrivilege	4544	NVIDIA Container.exe
Token: SeDebugPrivilege	3236	RuntimeBroker.exe
Token: SeDebugPrivilege	1632	SppExtComObj.exe
Token: SeDebugPrivilege	1840	NVIDIA Container.exe
Token: SeDebugPrivilege	1560	RuntimeBroker.exe
Token: SeDebugPrivilege	5108	SppExtComObj.exe
Token: SeDebugPrivilege	1136	NVIDIA Container.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 452	2128	Ention FULL.exe	85
PID 2128 wrote to memory of 452	2128	Ention FULL.exe	85
PID 2128 wrote to memory of 452	2128	Ention FULL.exe	85
PID 452 wrote to memory of 1784	452	NVIDIA Container.exe	87
PID 452 wrote to memory of 1784	452	NVIDIA Container.exe	87
PID 452 wrote to memory of 1784	452	NVIDIA Container.exe	87
PID 1784 wrote to memory of 4352	1784	WScript.exe	88
PID 1784 wrote to memory of 4352	1784	WScript.exe	88
PID 1784 wrote to memory of 4352	1784	WScript.exe	88
PID 4352 wrote to memory of 4140	4352	cmd.exe	90
PID 4352 wrote to memory of 4140	4352	cmd.exe	90
PID 4140 wrote to memory of 3872	4140	NVIDIA Container.exe	101
PID 4140 wrote to memory of 3872	4140	NVIDIA Container.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Ention FULL.exe
"C:\Users\Admin\AppData\Local\Temp\Ention FULL.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
  "C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
        
        "C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4140
      - C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe
        
        "C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NVIDIA ContainerN" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NVIDIA Container" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NVIDIA ContainerN" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe
"C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe
"C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe
"C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe
"C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe
"C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe
"C:\Program Files (x86)\Reference Assemblies\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe
"C:\Program Files\Internet Explorer\it-IT\SppExtComObj.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe
"C:\Program Files (x86)\Internet Explorer\SIGNUP\NVIDIA Container.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NVIDIA Container.exe

Path C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
Size 1.4MB
SHA256 b495e22042b08f27b690da18986ec74d5054a65d05d5cf41fdecd5751482ccbd
MD5 4a591f46c87b49a7de93f5ac771cd4ab
SHA1 e0992350818e5c56d3f2e3a6db340d1f5b8f3314
SHA512 b498445d1e427853690250aebff35cbd7e28e85a89ad868e3483930b16ec13198357cfcd5feb45567b1bc8f3d9f97c5ecf2d242c8a5e9d758a536d0498ba7955
SSDEEP 24576:gi39O3pP/GFPWjOo8hSrOfT4tPSNUIF+lL+FsxQ/MR9Gv6Yv+aX7:gwRVQysEUCHaiy9Gvk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mxJne99RtKqQDunPUGdos.bat

Path C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat
Size 53B
SHA256 0385dbf94fc27705560cf0b6b04e9a37181db486ee8f7573c5ad2217d18f4ca0
MD5 7784d810f5ff3afa8df50e360eb90e7d
SHA1 f04802a991ff6461aa1c35b7c0f68e43d5a114c6
SHA512 80038ae2bfd5f8ca3f4812ab5c342878f98978007125c9dca5edb915701a5383916131cdc3082c054c49c508cd210aff70319ac0fc498cbdd6cee776df672cac
MD5 SHA1 SHA512

Submit Download

zajaYJ4rqwpmDK2a6yrvwdV.vbe

Path C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe
Size 225B
SHA256 d3bf5c54de984dd2d1d779494deb8a995cc062eb5f25c465d0de78d99b8cc52b
MD5 d7df2670ad0c6c7b9cc48122f20f086c
SHA1 e69bf8c214d8c4b768125ca03e402e1c871cc233
SHA512 05ed88410790bf74dc7ab880f893e555c4859c133e79a89f28b5e1a68c36f4a4f28d3b7b6532953c04b6d23a21faf53e60107efde9e6acb492a9235d48943f03
MD5 SHA1 SHA512

Submit Download

NVIDIA Container.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NVIDIA Container.exe.log
Size 1KB
SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
MD5 7800fca2323a4130444c572374a030f4
SHA1 40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA512 c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554
MD5 SHA1 SHA512

Submit Download

SppExtComObj.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log
Size 1KB
SHA256 2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73
MD5 3690a1c3b695227a38625dcf27bd6dac
SHA1 c2ed91e98b120681182904fa2c7cd504e5c4b2f5
SHA512 15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1
MD5 SHA1 SHA512

Submit Download

NVIDIA Container.exe

Path C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
Size 1.8MB
SHA256 67942630366d114efa35f3f4a79741a4a4eb2c3b0c8ffaac07af527f84d4489a
MD5 531bf67134a7c1fb4096113ca58cc648
SHA1 99e0fc1fb7a07c0685e426b327921d3e6c34498c
SHA512 8facae8335a4f33f54e48c64814946eb8b480800b4453612fffcef64117946a35d493f433d4e27186ee864603da756319f816e70c3bfc08b8bb1861fc7030ff4
SSDEEP 24576:92G/nvxW3WDGkIJ1i39O3pP/GFPWjOo8hSrOfT4tPSNUIF+lL+FsxQ/MR9Gv6Yvg:9bA3gy1wRVQysEUCHaiy9Gvkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2128-1-0x0000000000990000-0x0000000000FEA000-memory.dmp

Download

memory/2128-4-0x00007FFDBD360000-0x00007FFDBDE21000-memory.dmp

Download

memory/2128-19-0x00007FFDBD360000-0x00007FFDBDE21000-memory.dmp

Download

memory/2128-0-0x00007FFDBD363000-0x00007FFDBD365000-memory.dmp

Download

memory/4140-26-0x0000000000A70000-0x0000000000BDA000-memory.dmp

Download

memory/4140-29-0x000000001B810000-0x000000001B826000-memory.dmp

Download

memory/4140-28-0x000000001B860000-0x000000001B8B0000-memory.dmp

Download

memory/4140-32-0x000000001B840000-0x000000001B84E000-memory.dmp

Download

memory/4140-31-0x000000001B830000-0x000000001B83E000-memory.dmp

Download

memory/4140-33-0x000000001B850000-0x000000001B85C000-memory.dmp

Download

memory/4140-30-0x0000000001410000-0x0000000001420000-memory.dmp

Download

memory/4140-27-0x000000001B7F0000-0x000000001B80C000-memory.dmp

Download