dcrat | 22cd06e32db67b2a913ac6b2a4b6c28e1e255f4a37e2b1ff98aea7a6232cc483

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe
Size

1.0MB
MD5

8eda5e69afffb4296509516af4e6d35b
SHA1

eca88c2f22ea72e6949cd386019bacfdd09ce4db
SHA256

22cd06e32db67b2a913ac6b2a4b6c28e1e255f4a37e2b1ff98aea7a6232cc483
SHA512

128624639dd6f9ce649059f142f891da016ad0fa9cead3259278f1be4c4a4e602a6d554290b2ae82045570ce8d1a4860cd38743d28297e8fa3c9788a51eb1bc4
SSDEEP

24576:B2G/nvxW3WUhrJYtHKkTo24gSzSRhCP1GGGqsu:BbA3ZhrJcqCHgek1GVy

Score

10^/10

dcrat discovery evasion infostealer persistence rat

Malware Config

Signatures

DcRat 6 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe
		2664	schtasks.exe
		2568	schtasks.exe
		2660	schtasks.exe
		2596	schtasks.exe
		3056	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2672	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2672	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2672	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2672	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2672	schtasks.exe	35

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000700000001878c-9.dat	dcrat
behavioral1/memory/2108-13-0x0000000000B20000-0x0000000000C26000-memory.dmp	dcrat
behavioral1/memory/1028-31-0x0000000000DB0000-0x0000000000EB6000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2108	Java.exe
1028	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
468	cmd.exe
468	cmd.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\System32\\NlsLexicons0010\\services.exe\""	Java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\PerfLogs\\Admin\\csrss.exe\""	Java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\smss.exe\""	Java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\18fc4542-69f6-11ef-a46c-62cb582c238c\\Idle.exe\""	Java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Documents and Settings\\services.exe\""	Java.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\NlsLexicons0010\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d	Java.exe
File created	C:\Windows\System32\NlsLexicons0010\services.exe	Java.exe
File opened for modification	C:\Windows\System32\NlsLexicons0010\services.exe	Java.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\smss.exe	Java.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\69ddcba757bf72f7d36c464c71f42baab150b2b9	Java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1796	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2664	schtasks.exe
2568	schtasks.exe
2660	schtasks.exe
2596	schtasks.exe
3056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2108	Java.exe
1028	smss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	Java.exe
Token: SeDebugPrivilege	1028	smss.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2148	2832	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe	31
PID 2832 wrote to memory of 2148	2832	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe	31
PID 2832 wrote to memory of 2148	2832	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe	31
PID 2832 wrote to memory of 2148	2832	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe	31
PID 2148 wrote to memory of 468	2148	WScript.exe	32
PID 2148 wrote to memory of 468	2148	WScript.exe	32
PID 2148 wrote to memory of 468	2148	WScript.exe	32
PID 2148 wrote to memory of 468	2148	WScript.exe	32
PID 468 wrote to memory of 2108	468	cmd.exe	34
PID 468 wrote to memory of 2108	468	cmd.exe	34
PID 468 wrote to memory of 2108	468	cmd.exe	34
PID 468 wrote to memory of 2108	468	cmd.exe	34
PID 2108 wrote to memory of 1056	2108	Java.exe	41
PID 2108 wrote to memory of 1056	2108	Java.exe	41
PID 2108 wrote to memory of 1056	2108	Java.exe	41
PID 468 wrote to memory of 1796	468	cmd.exe	43
PID 468 wrote to memory of 1796	468	cmd.exe	43
PID 468 wrote to memory of 1796	468	cmd.exe	43
PID 468 wrote to memory of 1796	468	cmd.exe	43
PID 1056 wrote to memory of 1352	1056	cmd.exe	44
PID 1056 wrote to memory of 1352	1056	cmd.exe	44
PID 1056 wrote to memory of 1352	1056	cmd.exe	44
PID 1056 wrote to memory of 304	1056	cmd.exe	45
PID 1056 wrote to memory of 304	1056	cmd.exe	45
PID 1056 wrote to memory of 304	1056	cmd.exe	45
PID 1056 wrote to memory of 1028	1056	cmd.exe	46
PID 1056 wrote to memory of 1028	1056	cmd.exe	46
PID 1056 wrote to memory of 1028	1056	cmd.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\FCDZbiNDzDjwOG7hoSx8OUBmM.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\cVz9U.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\Java.exe
      "C:\Users\Admin\AppData\Roaming\\Roaming\java\webview\localstorage\Java.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZdWWEkOcuS.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1056
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1352
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:304
      - C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\smss.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\smss.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons0010\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\PerfLogs\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Documents and Settings\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ZdWWEkOcuS.bat

Filesize
255B

MD5
c62c887c87d572e9f5a2216e03057b3e

SHA1
96fffcb517e41534ae365d75286ec31bd04352c4

SHA256
4391f8c183719eda9781174a733421d46660c14e6a84ff58acec048923116117

SHA512
e3accddc9e838257445749612aa60dabb46bcfdfbb2fa031359a5a77b9a106f0c08356165cba6eb0ba965e990658f79b5c8c43b40e8eeafd3462e894c31d41b7

Download Submit
C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\FCDZbiNDzDjwOG7hoSx8OUBmM.vbe

Filesize
223B

MD5
93405408468fb76bea37499dedd49714

SHA1
a1ecf38d3d46f706086c122df9fca3b3fd03df06

SHA256
251d2ad5c2e2da46320b0f90270f091a4999116e800d82868a57a4493e7a73bd

SHA512
e85aa92253a0dd56158549cf56c6461fbf50e628a76f089b27dd8f3e70fa970705f7c5be0eaae01ae6d3e25db636cf79cbc0be81d17417a4427ccda425c99063

Download Submit
C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\cVz9U.bat

Filesize
167B

MD5
c64e03b33cae1fd0b843d923fe99ed5a

SHA1
cc0198bfd1fdcbc78425f53ed35c937ee112e2f5

SHA256
577afb170fcd975da1416321d15c1cccb43df3f71bcab611d2f9cf3a488465d5

SHA512
2a81eb0ec8a0193902ff1d38a83b40fa126233f236e7290031f20efc11f3b94718ea9f06fc00dfe6541620cc8c21d8c5ca28c930ac4e462dc2f30528f0d1f133

Download Submit
\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\Java.exe

Filesize
1023KB

MD5
0f4c35061294cedeca25dd4e56246b2c

SHA1
f5f7cf1c9b001650f0f6bba5288648f28b01ddf4

SHA256
e73b8476bc0ee7948c953f3994081c835bf650f786602647046fdcefa7d8f4c6

SHA512
15eba2293ed1ebd861db4f904d92ca66c3a25c1b6dae7593c27cfda3af776d542b944fe3c5364a0556f5d085f0a222b4a2b93cd92f7d5b4378295c6ee6810624

Download Submit
memory/1028-31-0x0000000000DB0000-0x0000000000EB6000-memory.dmp

Filesize
1.0MB

Download
memory/1028-32-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download
memory/1028-33-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download
memory/1028-34-0x0000000000320000-0x000000000032C000-memory.dmp

Filesize
48KB

Download
memory/2108-13-0x0000000000B20000-0x0000000000C26000-memory.dmp

Filesize
1.0MB

Download