dcrat | fad9c2f147e0559c2f483f0643c01a0120710b07b15e9c9773d6eab00f15e289

General

Target

2c03dd0e127867ade0480bf34520df59.exe
Size

1.1MB
MD5

2c03dd0e127867ade0480bf34520df59
SHA1

fb153921a2a82b46022745c37595347b6f6065e3
SHA256

fad9c2f147e0559c2f483f0643c01a0120710b07b15e9c9773d6eab00f15e289
SHA512

006431d94bebf6530fb1cf7b690feaecd090d4d4a9d731d92cca6089fd772ada727bfd7ebc3fc84c1f183d700dab1cb2aac8116a3a92f86c8260dfb06602307d
SSDEEP

24576:U2G/nvxW3Ww0tigSFVbkXLQA9lfyN7SrCGP:UbA30i1A8BWrCc

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000234e2-10.dat	dcrat
behavioral2/memory/3812-13-0x0000000000350000-0x0000000000426000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	2c03dd0e127867ade0480bf34520df59.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3812	bridgeBlockcrt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	pastebin.com
23	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c03dd0e127867ade0480bf34520df59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	2c03dd0e127867ade0480bf34520df59.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3812	bridgeBlockcrt.exe
3812	bridgeBlockcrt.exe
3812	bridgeBlockcrt.exe
3812	bridgeBlockcrt.exe
3812	bridgeBlockcrt.exe
3812	bridgeBlockcrt.exe
3812	bridgeBlockcrt.exe
3812	bridgeBlockcrt.exe
3812	bridgeBlockcrt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3812	bridgeBlockcrt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	bridgeBlockcrt.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2944	4460	2c03dd0e127867ade0480bf34520df59.exe	87
PID 4460 wrote to memory of 2944	4460	2c03dd0e127867ade0480bf34520df59.exe	87
PID 4460 wrote to memory of 2944	4460	2c03dd0e127867ade0480bf34520df59.exe	87
PID 2944 wrote to memory of 4588	2944	WScript.exe	91
PID 2944 wrote to memory of 4588	2944	WScript.exe	91
PID 2944 wrote to memory of 4588	2944	WScript.exe	91
PID 4588 wrote to memory of 3812	4588	cmd.exe	93
PID 4588 wrote to memory of 3812	4588	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2c03dd0e127867ade0480bf34520df59.exe
"C:\Users\Admin\AppData\Local\Temp\2c03dd0e127867ade0480bf34520df59.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BridgeMssavesNet\BV6pkpwwN9itSlKcugIX54TBhptT.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BridgeMssavesNet\5MlI9N3fzCQPyBJiYN9phAi6Wm.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\BridgeMssavesNet\bridgeBlockcrt.exe
      "C:\BridgeMssavesNet\bridgeBlockcrt.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BridgeMssavesNet\5MlI9N3fzCQPyBJiYN9phAi6Wm.bat

Filesize
40B

MD5
510ac9d3b66719b2b987361c96833cf2

SHA1
e910552d71dd9d38002b8480b7f7b15134a9dec2

SHA256
f9cbdfc9f2f6dd97d2d27c37f070e46ff6b97e316ba5dea9e8faada4ffbbbeed

SHA512
516ed4ec0005a9ef27098b7e0b44162514244c689353f46b20ad5df049110576acbb76f540f251053683a2bb6f0083d585c01ef076dc94f945d1188b6a65654f

Download Submit
C:\BridgeMssavesNet\BV6pkpwwN9itSlKcugIX54TBhptT.vbe

Filesize
219B

MD5
63ec9e6deaa6f93ac2b7019358f4c2ef

SHA1
d0d45f71ff825edc8261d0a38ce8ca6bddcf68d1

SHA256
690a093c3eb93b5198b62e551a3f11438f9fd94cd05a9cc7a5bd1a2e2d69f3e1

SHA512
34b91eba2e1ab33ba78863f269b5a34fd29b018d0213598a7a0a431d88324b261d57ff55b1c7beed6ea168b5e614374b78295ec80399cf1f505cf51fd8c057c7

Download Submit
C:\BridgeMssavesNet\bridgeBlockcrt.exe

Filesize
828KB

MD5
769fbb392481f2acbffbb4ab1af6689e

SHA1
9d4c5457197b9ed22077e096d945cb28b81bf1f3

SHA256
e1f0f56259125ce4761d926d37b53d3a517828cf86b6ddb6728ec60086c7e38e

SHA512
2e59d2553d300eba6874dd5fb222e282d3b448bf1b052814874970378f5207c9065a5080d6a8c6756c26c49b747e6f0e7abb8e9befd8a70b2293920d411c8801

Download Submit
memory/3812-12-0x00007FF809483000-0x00007FF809485000-memory.dmp

Filesize
8KB

Download
memory/3812-13-0x0000000000350000-0x0000000000426000-memory.dmp

Filesize
856KB

Download
memory/3812-14-0x00007FF809483000-0x00007FF809485000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing