dcrat | 54b542bd706838bc61c23ef8189935fc74e0099b14e509d33649b43ff108d85f

Analysis

max time kernel
0s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Redline-crack-by-rzt/Panel/RedLine_20_2/Panel/panel.exe
Size

16.4MB
MD5

1246b7d115005ce9fcc96848c5595d72
SHA1

fa3777c7fe670cea2a4e8267945c3137091c64b5
SHA256

f01393937f06be201400703d1dbfb35397c4a5162f16278ba9d9bb63ddcbcc78
SHA512

5bf90904cf74a8c3775498578d856dd9f4837077928cd7ce24e4a6ccec00827bcfb28c2079498ba682a4f53204d7ad2bb8de2489005c429dc968e75e26d29101
SSDEEP

393216:gyOsihmjY/uAKJkDk4x/aQsY3K/jRsBp:FOLhmjY/utek4x/aQsyKLuBp

Score

10^/10

dcrat redline discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2644	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2644	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2644	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2644	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2644	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2644	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2644	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2644	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2644	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2644	schtasks.exe	33

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral23/memory/4916-3912-0x000000001F5F0000-0x000000001F60A000-memory.dmp	family_redline

Redline family
redline

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral23/memory/1524-21-0x0000000001360000-0x000000000179C000-memory.dmp	dcrat
behavioral23/memory/2976-134-0x0000000000090000-0x00000000004CC000-memory.dmp	dcrat
behavioral23/memory/1524-133-0x0000000001360000-0x000000000179C000-memory.dmp	dcrat
behavioral23/memory/2976-132-0x0000000000090000-0x00000000004CC000-memory.dmp	dcrat
behavioral23/memory/2976-4008-0x0000000000090000-0x00000000004CC000-memory.dmp	dcrat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

panel.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	panel.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2252	schtasks.exe
2400	schtasks.exe
2372	schtasks.exe
1856	schtasks.exe
2528	schtasks.exe
1388	schtasks.exe
2912	schtasks.exe
1312	schtasks.exe
1564	schtasks.exe
1980	schtasks.exe
2564	schtasks.exe
2812	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe
"C:\Users\Admin\AppData\Local\Temp\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2348
- C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe
  "C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe"
  2⤵
  PID:1524
- - C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe
    "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe"
    3⤵
    PID:2976
- C:\Users\Admin\AppData\Local\Temp\Panel.exe
  "C:\Users\Admin\AppData\Local\Temp\Panel.exe"
  2⤵
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Panel.exe
    "C:\Users\Admin\AppData\Local\Temp\Panel.exe" "--monitor"
    3⤵
    PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Panel.exe

Filesize
8.8MB

MD5
c4fa0c069d51e405413b9a3ce742f598

SHA1
725c2197874bd28a8eba9cc65e56a1c9caf4a222

SHA256
51c5b4cdd69582ba00fb8a62ebdcf00da5db82bb128181ec99174d8ae33a069e

SHA512
75ded8ea7e77467a9ac62a7664ecb15bf93af0c6bc538d7f5a871e870a4d3b76fd48bab567f6c773f48673100e3e26efa574dd197d97d82fc079ae2c7e030e21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Panel.exe

Filesize
7.6MB

MD5
f2610b36efbda862bf35ac7331988450

SHA1
a105f37fdcfab8e8bee1cc74f86fb50f248820c1

SHA256
e27ff5ea2c2e94f719727e4272c58e39cb428e1f3fdf32b862a94c6886d23984

SHA512
fb7a366f2915e41999014a7e08034e502a44b6b3fddd8d8a8454b3b134b9bef52c4766c5db1270c54547f872d0cd863f6a1db6f37aa5cba38af276c0c1045b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Panel.exe

Filesize
6.6MB

MD5
d9c59400c99bc4966568be5ee0755635

SHA1
622bdc0ba316569711ec600e6b054fd79799fea9

SHA256
29b4a240731517052133a84daa9d2350f349c51480e05575885ce713d8bb8282

SHA512
26f8eceb1ff461c4e59116a3ce05abf1afe697d6cab9103af0ecffd3fe4fb1629e55ce3a788bf715248a6157d8746706d9dc6e10e536e6b984b60587fb374474

Download Submit
\Users\Admin\AppData\Local\Temp\Panel.exe

Filesize
8.6MB

MD5
d0201c48a483a3b8bac5da2427642911

SHA1
5f8a75344bdf6b9bc21e9b70f73d5bc98bb23382

SHA256
0f3f4b7b6cbefdeda4edbfb82e538aeb07982c186e4444fc530c9fdf1d967b93

SHA512
f70e0181182e6ec6475cf268c64fdf23dd6f8d8b77e87fdd07ca4387bb0a808d71d974e8f0983baa372195350db34ce0b97303b220ee4cf2e32703bc18dfb3d0

Download Submit
\Users\Admin\AppData\Local\Temp\Panel.exe

Filesize
7.1MB

MD5
01476cbe52a561a8d9ff67a1d81e63ff

SHA1
a86aca1c0dcc6fecece4d6c35d2fa2678b671347

SHA256
ff3529eb6128be74ecb0f70af8155433650e6cf2e2b9dd4e84b324e826fc627b

SHA512
d1b38b61e660a0c70d1ba747085291bc5b5827fb7d0b445a7e6743c7e200df39f3d1f18dbb396891ad5c8302e7cfe445a1ee9162fdc57cef3cb73285ed088fd0

Download Submit
\Users\Admin\AppData\Local\Temp\Panel.exe

Filesize
6.9MB

MD5
46906030eae56e9a931716049b9091ca

SHA1
0b22b215d032fea9d182b4cef0fa54d26925a815

SHA256
2b125eb6dcfa82d9b24b0fa89b2d30cc762efd380bad0d50ce9b4a180d4d738c

SHA512
a0203046a26d91797c0e2f25ae0afe2a7cd956c906bad1b8ba49c1a30503e72cdd81cd9f48cfe13796e962635de3beebbf5ea51af218a9117715a953eda9d1f6

Download Submit
\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe

Filesize
1.5MB

MD5
fcbf03d90d4e9ce80f575452266e71d1

SHA1
1b067d0e057db189c71b2f7ac4ee2483ebaf0fa7

SHA256
2ec28f57e64fee2b2f1a40c78c079672f0dddb84da2a84fe3291bd68a4771a73

SHA512
9ce9962f645ab542f135d8560a7095259fe6628afcf598a58dfcf8e96b0d1dfa73e59ce13af3ff97e6c03046634dbd46a278c6535f99f99b3a6051b7bbfcf380

Download Submit
memory/1524-111-0x0000000008B00000-0x0000000008F3C000-memory.dmp

Filesize
4.2MB

Download
memory/1524-21-0x0000000001360000-0x000000000179C000-memory.dmp

Filesize
4.2MB

Download
memory/1524-19-0x0000000001360000-0x000000000179C000-memory.dmp

Filesize
4.2MB

Download
memory/1524-112-0x0000000008B00000-0x0000000008F3C000-memory.dmp

Filesize
4.2MB

Download
memory/1524-133-0x0000000001360000-0x000000000179C000-memory.dmp

Filesize
4.2MB

Download
memory/2348-3990-0x0000000005AD0000-0x0000000005F0C000-memory.dmp

Filesize
4.2MB

Download
memory/2348-0-0x0000000000400000-0x0000000001470000-memory.dmp

Filesize
16.4MB

Download
memory/2348-15-0x0000000005AD0000-0x0000000005F0C000-memory.dmp

Filesize
4.2MB

Download
memory/2348-18-0x0000000005AD0000-0x0000000005F0C000-memory.dmp

Filesize
4.2MB

Download
memory/2976-4008-0x0000000000090000-0x00000000004CC000-memory.dmp

Filesize
4.2MB

Download
memory/2976-129-0x0000000000090000-0x00000000004CC000-memory.dmp

Filesize
4.2MB

Download
memory/2976-132-0x0000000000090000-0x00000000004CC000-memory.dmp

Filesize
4.2MB

Download
memory/2976-134-0x0000000000090000-0x00000000004CC000-memory.dmp

Filesize
4.2MB

Download
memory/2992-40-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/2992-44-0x000000001E100000-0x000000001E242000-memory.dmp

Filesize
1.3MB

Download
memory/2992-73-0x000000001DE40000-0x000000001DE4A000-memory.dmp

Filesize
40KB

Download
memory/2992-34-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/2992-33-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/2992-23-0x000000001B260000-0x000000001B400000-memory.dmp

Filesize
1.6MB

Download
memory/2992-76-0x000000001DE40000-0x000000001DE4A000-memory.dmp

Filesize
40KB

Download
memory/2992-78-0x000000001DE40000-0x000000001DE4A000-memory.dmp

Filesize
40KB

Download
memory/2992-86-0x000000001DE50000-0x000000001DE5A000-memory.dmp

Filesize
40KB

Download
memory/2992-36-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/2992-130-0x000000001E220000-0x000000001E23C000-memory.dmp

Filesize
112KB

Download
memory/2992-49-0x000000001E100000-0x000000001E242000-memory.dmp

Filesize
1.3MB

Download
memory/2992-57-0x000000001E250000-0x000000001E392000-memory.dmp

Filesize
1.3MB

Download
memory/2992-74-0x000000001DE40000-0x000000001DE4A000-memory.dmp

Filesize
40KB

Download
memory/2992-45-0x000000001E100000-0x000000001E242000-memory.dmp

Filesize
1.3MB

Download
memory/2992-38-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/2992-20-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-22-0x000000001B260000-0x000000001B400000-memory.dmp

Filesize
1.6MB

Download
memory/2992-24-0x000000001B260000-0x000000001B400000-memory.dmp

Filesize
1.6MB

Download
memory/4916-3955-0x000000001F780000-0x000000001F830000-memory.dmp

Filesize
704KB

Download
memory/4916-3989-0x000000001FF90000-0x0000000020004000-memory.dmp

Filesize
464KB

Download
memory/4916-3940-0x000000001F690000-0x000000001F6CA000-memory.dmp

Filesize
232KB

Download
memory/4916-4004-0x0000000020410000-0x000000002045A000-memory.dmp

Filesize
296KB

Download
memory/4916-3926-0x000000001F630000-0x000000001F642000-memory.dmp

Filesize
72KB

Download
memory/4916-3912-0x000000001F5F0000-0x000000001F60A000-memory.dmp

Filesize
104KB

Download