dcrat | 6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219

General

Target

6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe
Size

1.2MB
MD5

321f612c6caf1fd630725623fe40a5fe
SHA1

8cf094d5074445dd427987edc583e90c09eb4c1b
SHA256

6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219
SHA512

6aed7fde3c3f52c14e1c0f44b64147c0ed4c9c87b93c02e354ff7364a0296ed0affa2fb2c3caf73e07f764ce7d7840acb5e4e02f7e1fe1031b6226f18af5610f
SSDEEP

24576:P2G/nvxW3WsLG9Eiz6adDRmCICoh3yfB0R9We1tHJTiBdTadFOQxQUS2NQtLqv7P:PbA3vLG9Eiz6adDRmCICoh3yfB0R9Wef

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat 13 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4760	schtasks.exe
		4088	schtasks.exe
		4776	schtasks.exe
		4744	schtasks.exe
		1492	schtasks.exe
		1432	schtasks.exe
		2924	schtasks.exe
		4800	schtasks.exe
		4916	schtasks.exe
		4856	schtasks.exe
		1376	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe
		4348	schtasks.exe

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	5044	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	5044	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cbc-10.dat	dcrat
behavioral2/memory/3864-13-0x0000000000910000-0x00000000009FA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	driverintoperfCommonsessiondll.exe

Executes dropped EXE 1 IoCs

pid	Process
3864	driverintoperfCommonsessiondll.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.tr-tr\\OfficeClickToRun.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\rasadhlp\\conhost.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Documents and Settings\\backgroundTaskHost.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\ProgramData\\Microsoft OneDrive\\setup\\upfc.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\SysWOW64\\fltLib\\cmd.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0\\OfficeClickToRun.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\capisp\\RuntimeBroker.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\pcalua\\SppExtComObj.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\tracing\\winlogon.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\System32\\dinput8\\backgroundTaskHost.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\PerfLogs\\taskhostw.exe\""	driverintoperfCommonsessiondll.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\capisp\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	driverintoperfCommonsessiondll.exe
File created	C:\Windows\System32\pcalua\e1ef82546f0b02b7e974f28047f3788b1128cce1	driverintoperfCommonsessiondll.exe
File created	C:\Windows\System32\dinput8\eddb19405b7ce1152b3e19997f2b467f0b72b3d3	driverintoperfCommonsessiondll.exe
File created	C:\Windows\System32\rasadhlp\088424020bedd6b28ac7fd22ee35dcd7322895ce	driverintoperfCommonsessiondll.exe
File created	C:\Windows\System32\dinput8\backgroundTaskHost.exe	driverintoperfCommonsessiondll.exe
File created	C:\Windows\SysWOW64\fltLib\cmd.exe	driverintoperfCommonsessiondll.exe
File created	C:\Windows\SysWOW64\fltLib\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228	driverintoperfCommonsessiondll.exe
File created	C:\Windows\System32\capisp\RuntimeBroker.exe	driverintoperfCommonsessiondll.exe
File created	C:\Windows\System32\pcalua\SppExtComObj.exe	driverintoperfCommonsessiondll.exe
File created	C:\Windows\System32\rasadhlp\conhost.exe	driverintoperfCommonsessiondll.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr\e6c9b481da804f07baff8eff543b0a1441069b5d	driverintoperfCommonsessiondll.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0\OfficeClickToRun.exe	driverintoperfCommonsessiondll.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0\e6c9b481da804f07baff8eff543b0a1441069b5d	driverintoperfCommonsessiondll.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr\OfficeClickToRun.exe	driverintoperfCommonsessiondll.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tracing\winlogon.exe	driverintoperfCommonsessiondll.exe
File created	C:\Windows\tracing\cc11b995f2a76da408ea6a601e682e64743153ad	driverintoperfCommonsessiondll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	driverintoperfCommonsessiondll.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4800	schtasks.exe
4916	schtasks.exe
4776	schtasks.exe
4348	schtasks.exe
1492	schtasks.exe
1432	schtasks.exe
2924	schtasks.exe
4760	schtasks.exe
4088	schtasks.exe
4856	schtasks.exe
1376	schtasks.exe
4744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3864	driverintoperfCommonsessiondll.exe
3864	driverintoperfCommonsessiondll.exe
3864	driverintoperfCommonsessiondll.exe
3864	driverintoperfCommonsessiondll.exe
3864	driverintoperfCommonsessiondll.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	driverintoperfCommonsessiondll.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3388	1852	6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe	86
PID 1852 wrote to memory of 3388	1852	6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe	86
PID 1852 wrote to memory of 3388	1852	6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe	86
PID 3388 wrote to memory of 2696	3388	WScript.exe	87
PID 3388 wrote to memory of 2696	3388	WScript.exe	87
PID 3388 wrote to memory of 2696	3388	WScript.exe	87
PID 2696 wrote to memory of 3864	2696	cmd.exe	89
PID 2696 wrote to memory of 3864	2696	cmd.exe	89
PID 3864 wrote to memory of 1768	3864	driverintoperfCommonsessiondll.exe	104
PID 3864 wrote to memory of 1768	3864	driverintoperfCommonsessiondll.exe	104
PID 1768 wrote to memory of 4732	1768	cmd.exe	106
PID 1768 wrote to memory of 4732	1768	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe
"C:\Users\Admin\AppData\Local\Temp\6095c3b37ce46a00267f8bd43345e1e83f366875901c0cdfd22349360c930219.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\driverintoperfCommon\wlmoRFgBvo.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\driverintoperfCommon\vJSmSBhcFKfKb07LK.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\driverintoperfCommon\driverintoperfCommonsessiondll.exe
      "C:\driverintoperfCommon\driverintoperfCommonsessiondll.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dMk1o1EdOC.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1768
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\PerfLogs\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\SysWOW64\fltLib\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\setup\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\capisp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\pcalua\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\rasadhlp\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\tracing\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Documents and Settings\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\System32\dinput8\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dMk1o1EdOC.bat

Filesize
195B

MD5
4cf14c5c0a2cca88e5f093ee021c20c3

SHA1
730a0adc8600f3c6c3c205fb500daf49501c3434

SHA256
ff9c501b81959d353b0fb0e4cbeb75fe45854f94ab58acbea30aed152f2d2f21

SHA512
c0dfcbb755cfb424dc205fb61ee78f07d49678cc3646ffec385a7c7923771cdb8eb29536ec8be3a83ecdbe46a454b3d94fdc58a8389233d7827f7d1e863a2343

Download Submit
C:\driverintoperfCommon\driverintoperfCommonsessiondll.exe

Filesize
911KB

MD5
056f58dfd4dbd2472994437d57da6515

SHA1
b25732eeed9b92fa7c41e4d5f624e543841fb889

SHA256
6ab8569493f8b26107d701117956341d4b880ffa0d5e5e498380e9e21fad6ca4

SHA512
1d2f09ad6b752ab5d18797ebbc22991e04a3df27e3dce85f31446690c595b6550cd9db6ec69aaa57b307e36d3f1f247fb37bdfa9fb76496a3fa5e76423e7e1d3

Download Submit
C:\driverintoperfCommon\vJSmSBhcFKfKb07LK.bat

Filesize
60B

MD5
7714e2b53919911e980444b45460395e

SHA1
21cddd2196d4e75bbb2cc7707b94934932680d07

SHA256
6e0f83f0badfed55ce960d3f3b49b742c3f2bf50e36beefd48fdbb2d0b71bc8c

SHA512
2611942f953a7c4deaf4a80863279a309befa69171f2e657a671afc52b9540dbada2b147280ac2af05d71e78802ba56b0cd82bfe8799fcd53805ffa0b828ae03

Download Submit
C:\driverintoperfCommon\wlmoRFgBvo.vbe

Filesize
214B

MD5
b691364b66d675eeed04c145b61c1eec

SHA1
dc589cc90dea7c2337354951a18ddc456ef6cb19

SHA256
1028571339899a1c775e82790e37ce001554848fae43c5c58357474c94b5bd2b

SHA512
a807538e52b8acdbcc35d60df9b3ff1e529cd23c39a7a2a5afe19fc4a05ba46d9cb7ba1a7012f43c2b27eef7681dff8d3a9aa204fe85816146455ac0e1a8010c

Download Submit
memory/3864-12-0x00007FF9A48E3000-0x00007FF9A48E5000-memory.dmp

Filesize
8KB

Download
memory/3864-13-0x0000000000910000-0x00000000009FA000-memory.dmp

Filesize
936KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads