dcrat | 14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041

General

Target

14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
Size

973KB
MD5

9e2d06b56585b3d7cf2453d98c53de20
SHA1

5858c3ae6bdf0e1a2f4d15d02094cf0172946c52
SHA256

14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041
SHA512

c6b32a070a557c3bc23c807a419305f6bf91033a9d4a010c110c1221962718c3d0bb582ac20ff9e0344caa504545ea5aacfc17979003327fda1c192b962d4010
SSDEEP

12288:/hhBMuext92N3cit1RGJV/H0uQ1PjmzBd5EBy10cgZMc29ZxasnLlDD:/5E92NRzO/UFdmBchH29Zsg9

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	3360	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	3360	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	3360	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	3360	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	3360	schtasks.exe	82

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe

Executes dropped EXE 1 IoCs

pid	Process
4760	taskhostw.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\locale\\dwm.exe\""	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\storagewmi_passthru\\fontdrvhost.exe\""	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\PerfLogs\\taskhostw.exe\""	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\ProgramData\\WindowsHolographicDevices\\SpatialStore\\unsecapp.exe\""	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\storagewmi_passthru\fontdrvhost.exe	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
File created	C:\Windows\System32\storagewmi_passthru\5b884080fd4f94	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
File opened for modification	C:\Windows\System32\locale\RCX66DB.tmp	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
File opened for modification	C:\Windows\System32\locale\dwm.exe	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
File opened for modification	C:\Windows\System32\storagewmi_passthru\RCX68E0.tmp	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
File opened for modification	C:\Windows\System32\storagewmi_passthru\fontdrvhost.exe	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
File created	C:\Windows\System32\locale\dwm.exe	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
File created	C:\Windows\System32\locale\6cb0b6c459d5d3	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Boot\dwm.exe	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3860	schtasks.exe
3568	schtasks.exe
3260	schtasks.exe
2360	schtasks.exe
3276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4936	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
Token: SeDebugPrivilege	4760	taskhostw.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4760	4936	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe	88
PID 4936 wrote to memory of 4760	4936	14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe
"C:\Users\Admin\AppData\Local\Temp\14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Recovery\WindowsRE\taskhostw.exe
  "C:\Recovery\WindowsRE\taskhostw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\ProgramData\WindowsHolographicDevices\SpatialStore\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\locale\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\storagewmi_passthru\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\PerfLogs\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\taskhostw.exe

Filesize
973KB

MD5
9e2d06b56585b3d7cf2453d98c53de20

SHA1
5858c3ae6bdf0e1a2f4d15d02094cf0172946c52

SHA256
14fe2e3c3da4f7833248a28afe183191cb4a0bb4412fd6b7efdd2606542c8041

SHA512
c6b32a070a557c3bc23c807a419305f6bf91033a9d4a010c110c1221962718c3d0bb582ac20ff9e0344caa504545ea5aacfc17979003327fda1c192b962d4010

Download Submit
memory/4936-0-0x00007FF95A9B3000-0x00007FF95A9B5000-memory.dmp

Filesize
8KB

Download
memory/4936-1-0x0000000000890000-0x000000000098A000-memory.dmp

Filesize
1000KB

Download
memory/4936-2-0x00007FF95A9B0000-0x00007FF95B471000-memory.dmp

Filesize
10.8MB

Download
memory/4936-4-0x000000001B4F0000-0x000000001B500000-memory.dmp

Filesize
64KB

Download
memory/4936-5-0x000000001B510000-0x000000001B51C000-memory.dmp

Filesize
48KB

Download
memory/4936-3-0x000000001B4E0000-0x000000001B4E8000-memory.dmp

Filesize
32KB

Download
memory/4936-6-0x000000001B520000-0x000000001B52C000-memory.dmp

Filesize
48KB

Download
memory/4936-7-0x000000001B530000-0x000000001B538000-memory.dmp

Filesize
32KB

Download
memory/4936-67-0x00007FF95A9B0000-0x00007FF95B471000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads