dcrat | 2c9593138be6c386946e31595ccdd5550922ef3fdd843fbb5f1e83634c223a2a

General

Target

LisectAVT_2403002A_442.exe
Size

2.2MB
MD5

519c9f6fedeb43a8d129230fed9a2108
SHA1

534ce363aa81cba33e01330d449c081f6b5e4f87
SHA256

2c9593138be6c386946e31595ccdd5550922ef3fdd843fbb5f1e83634c223a2a
SHA512

ac8c10418e8ed4c2338378af4c8233196a2982405c551e033e0375c5abf523a552312b7c5664d1aed246e3177ac71c0ade7ecca3204ddb2cf1406ea055445521
SSDEEP

49152:UbA30bEln+8YPyZc6wkQbPVqlC8m5saKHaFg3:UbUJ+lyZKjVJDWaA

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat 5 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeLisectAVT_2403002A_442.exe

pid	process
3320	schtasks.exe
3844	schtasks.exe
2552	schtasks.exe
1356	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002A_442.exe

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	2240	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	2240	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2240	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2240	schtasks.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe	dcrat
behavioral2/memory/3088-13-0x0000000000260000-0x000000000044A000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LisectAVT_2403002A_442.exeWScript.exeperfCrtmonitorsvcMonitorDll.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	LisectAVT_2403002A_442.exe
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	perfCrtmonitorsvcMonitorDll.exe

Executes dropped EXE 2 IoCs

Processes:

perfCrtmonitorsvcMonitorDll.exeRuntimeBroker.exe

pid process

3088 perfCrtmonitorsvcMonitorDll.exe
3048 RuntimeBroker.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

perfCrtmonitorsvcMonitorDll.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Internal.Search\\SearchApp.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Documents and Settings\\sysmon.exe\""	perfCrtmonitorsvcMonitorDll.exe

Drops file in Windows directory 4 IoCs

Processes:

perfCrtmonitorsvcMonitorDll.exe

description	ioc	process
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\22eafd247d37c30fed3795ee41d259ec72bb351c	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Internal.Search\SearchApp.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Internal.Search\38384e6a620884a6b69bcc56f80d556f9200171c	perfCrtmonitorsvcMonitorDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

LisectAVT_2403002A_442.exeWScript.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002A_442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

Processes:

LisectAVT_2403002A_442.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings LisectAVT_2403002A_442.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

3320 schtasks.exe
3844 schtasks.exe
2552 schtasks.exe
1356 schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	LisectAVT_2403002A_442.exe

pid	process
3320	schtasks.exe
3844	schtasks.exe
2552	schtasks.exe
1356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

perfCrtmonitorsvcMonitorDll.exeRuntimeBroker.exe

pid	process
3088	perfCrtmonitorsvcMonitorDll.exe
3088	perfCrtmonitorsvcMonitorDll.exe
3088	perfCrtmonitorsvcMonitorDll.exe
3088	perfCrtmonitorsvcMonitorDll.exe
3088	perfCrtmonitorsvcMonitorDll.exe
3088	perfCrtmonitorsvcMonitorDll.exe
3088	perfCrtmonitorsvcMonitorDll.exe
3088	perfCrtmonitorsvcMonitorDll.exe
3048	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

perfCrtmonitorsvcMonitorDll.exeRuntimeBroker.exe

description pid process

Token: SeDebugPrivilege 3088 perfCrtmonitorsvcMonitorDll.exe
Token: SeDebugPrivilege 3048 RuntimeBroker.exe

description	pid	process
Token: SeDebugPrivilege	3088	perfCrtmonitorsvcMonitorDll.exe
Token: SeDebugPrivilege	3048	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

LisectAVT_2403002A_442.exeWScript.execmd.exeperfCrtmonitorsvcMonitorDll.exe

description	pid	process	target process
PID 4984 wrote to memory of 3024	4984	LisectAVT_2403002A_442.exe	WScript.exe
PID 4984 wrote to memory of 3024	4984	LisectAVT_2403002A_442.exe	WScript.exe
PID 4984 wrote to memory of 3024	4984	LisectAVT_2403002A_442.exe	WScript.exe
PID 3024 wrote to memory of 924	3024	WScript.exe	cmd.exe
PID 3024 wrote to memory of 924	3024	WScript.exe	cmd.exe
PID 3024 wrote to memory of 924	3024	WScript.exe	cmd.exe
PID 924 wrote to memory of 3088	924	cmd.exe	perfCrtmonitorsvcMonitorDll.exe
PID 924 wrote to memory of 3088	924	cmd.exe	perfCrtmonitorsvcMonitorDll.exe
PID 3088 wrote to memory of 3048	3088	perfCrtmonitorsvcMonitorDll.exe	RuntimeBroker.exe
PID 3088 wrote to memory of 3048	3088	perfCrtmonitorsvcMonitorDll.exe	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_442.exe
"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_442.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\Uj422BG5H91CLq69Aho3ql.vbe"
2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\Jg3j8KEAq3O.bat" "
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924

C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe
"C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088

C:\Users\Default\Cookies\RuntimeBroker.exe
"C:\Users\Default\Cookies\RuntimeBroker.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Internal.Search\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Documents and Settings\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\Jg3j8KEAq3O.bat

Filesize
58B

MD5
7c719c66000b0a22a451c0e4d3cdebf7

SHA1
6ed1082ffd2f07f82b0bac5753cd8e1bf3e12096

SHA256
711c9f3ea1cef74cf02fe1c4d98063a5d436f47db265491ddc4acfb48953fdd1

SHA512
97cb02f8def90e31bb094c14882f818033dc98e9297a0d5f8ad158ee1fede3608c13ae5b9e18d6a1f72f24450371593aa3d53f4a8e47dd555a1cf36d65997808

Download Submit
C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\Uj422BG5H91CLq69Aho3ql.vbe

Filesize
209B

MD5
b5ed2f061cf45ffd03bf99d750ace127

SHA1
23c74c327a8f47715534af018463eaaf82f4ba2a

SHA256
73755d7f9485eba68d61877c9d61950324c6d38eb0ed5005ed06dd0efdaa6a35

SHA512
a5c4577f60be3cf693f9c8904b632e2b25adf9696ba38caa68dc7f4fd47fa9c89dee3afe5656b6ecf9148a1ec4ff3bb09ce054b4eafacb4fe709ea61efc78419

Download Submit
C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe

Filesize
1.9MB

MD5
64b3ca21d783cfb2dde3ffbafbf1797f

SHA1
822549c0b397feeb5105c1ebfe570ddf685c926b

SHA256
91167e5876c370f49654a0749590b162b9432108940f84cf77690e26e367955c

SHA512
d6be88ce1ea5d6a54c07b56a8cb682fae729cfaae9758ed3cada42988c89a8a9b7dc038e754b06f8cb737602fe1d3b941c067e7e166c10a30e6541bee57efde3

Download Submit
memory/3048-34-0x000000001C200000-0x000000001C256000-memory.dmp

Filesize
344KB

Download
memory/3088-12-0x00007FFC0DDC3000-0x00007FFC0DDC5000-memory.dmp

Filesize
8KB

Download
memory/3088-13-0x0000000000260000-0x000000000044A000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads