dcrat | 8b72c7dce8c76cc75eb19390ca84dc43a2c8e47eb627b9894e534be9328e9ecc

General

Target

7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe
Size

827KB
MD5

759b333fd8d1eedb5666fdea1da25b25
SHA1

b66fc861196561f793062622b88cdb1065e35459
SHA256

7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e
SHA512

831006157773f5a30dbf07dcbfd484f49a978c077f8e132d33c8e044f8141462bb890c344724b23c3144488c1c406d576b7009c1205772a503ce6cc92692aec3
SSDEEP

12288:M+B2ad7F/Jf2xm1/nNfkOV+0Z3+5DlpAXdet4y5+q:gad7PuxmRn60Zu7xtZp

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	788	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	788	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	788	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	788	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	788	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	788	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	788	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	788	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	788	schtasks.exe	84

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/1468-1-0x0000000000810000-0x00000000008E6000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b7d-18.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe

Executes dropped EXE 1 IoCs

Processes:

fontdrvhost.exe

pid	Process
1644	fontdrvhost.exe

Drops file in Program Files directory 1 IoCs

Processes:

7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\csrss.exe	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe

Drops file in Windows directory 2 IoCs

Processes:

7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe

description	ioc	Process
File created	C:\Windows\addins\6cb0b6c459d5d3	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe
File created	C:\Windows\addins\dwm.exe	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
1484	schtasks.exe
1040	schtasks.exe
2676	schtasks.exe
1652	schtasks.exe
2180	schtasks.exe
3808	schtasks.exe
208	schtasks.exe
644	schtasks.exe
4736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exefontdrvhost.exe

pid	Process
1468	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe
1644	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exefontdrvhost.exe

description	pid	Process
Token: SeDebugPrivilege	1468	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe
Token: SeDebugPrivilege	1644	fontdrvhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.execmd.exe

description	pid	Process	procid_target
PID 1468 wrote to memory of 2432	1468	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe	94
PID 1468 wrote to memory of 2432	1468	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe	94
PID 2432 wrote to memory of 1064	2432	cmd.exe	96
PID 2432 wrote to memory of 1064	2432	cmd.exe	96
PID 2432 wrote to memory of 1644	2432	cmd.exe	103
PID 2432 wrote to memory of 1644	2432	cmd.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe
"C:\Users\Admin\AppData\Local\Temp\7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PN219sj1of.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1064
- - C:\Recovery\WindowsRE\fontdrvhost.exe
    "C:\Recovery\WindowsRE\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\addins\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\addins\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\fontdrvhost.exe

Filesize
827KB

MD5
759b333fd8d1eedb5666fdea1da25b25

SHA1
b66fc861196561f793062622b88cdb1065e35459

SHA256
7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e

SHA512
831006157773f5a30dbf07dcbfd484f49a978c077f8e132d33c8e044f8141462bb890c344724b23c3144488c1c406d576b7009c1205772a503ce6cc92692aec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\PN219sj1of.bat

Filesize
202B

MD5
d5b643e60a9169e5a5d8e2668ef65370

SHA1
231cf4b480f3109ab43777e53cc5b1a30c608ccf

SHA256
8837ebbde7343868ce357638585c1d83d2eb8236323f3bed775e8c439510d379

SHA512
8b77a70aeb6cdc57866e37ed304b781acf4aaa5600f8348603bf672e4427c7e420dbcebe963c4e30141b540b764d7184b8977534cc294a7586ef5761fe515500

Download Submit
memory/1468-0-0x00007FFBC4243000-0x00007FFBC4245000-memory.dmp

Filesize
8KB

Download
memory/1468-1-0x0000000000810000-0x00000000008E6000-memory.dmp

Filesize
856KB

Download
memory/1468-4-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

Filesize
10.8MB

Download
memory/1468-15-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads