dcrat | 22cd06e32db67b2a913ac6b2a4b6c28e1e255f4a37e2b1ff98aea7a6232cc483

General

Target

8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe
Size

1.0MB
MD5

8eda5e69afffb4296509516af4e6d35b
SHA1

eca88c2f22ea72e6949cd386019bacfdd09ce4db
SHA256

22cd06e32db67b2a913ac6b2a4b6c28e1e255f4a37e2b1ff98aea7a6232cc483
SHA512

128624639dd6f9ce649059f142f891da016ad0fa9cead3259278f1be4c4a4e602a6d554290b2ae82045570ce8d1a4860cd38743d28297e8fa3c9788a51eb1bc4
SSDEEP

24576:B2G/nvxW3WUhrJYtHKkTo24gSzSRhCP1GGGqsu:BbA3ZhrJcqCHgek1GVy

Score

10^/10

dcrat discovery evasion infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	4064	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	4064	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	4064	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	4064	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	4064	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	4064	schtasks.exe	94

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/files/0x000a000000023b8d-11.dat	dcrat
behavioral2/memory/1744-13-0x00000000007D0000-0x00000000008D6000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exeWScript.exeJava.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Java.exe

Executes dropped EXE 2 IoCs

Processes:

Java.exesysmon.exe

pid	Process
1744	Java.exe
5036	sysmon.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Java.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\Tasks\\conhost.exe\""	Java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Documents and Settings\\sysmon.exe\""	Java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\perfd00C\\fontdrvhost.exe\""	Java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	Java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\regedit\\explorer.exe\""	Java.exe

Drops file in System32 directory 2 IoCs

Processes:

Java.exe

description	ioc	Process
File created	C:\Windows\System32\perfd00C\5b884080fd4f94e2695da25c503f9e33b9605b83	Java.exe
File created	C:\Windows\System32\perfd00C\fontdrvhost.exe	Java.exe

Drops file in Windows directory 4 IoCs

Processes:

Java.exe

description	ioc	Process
File created	C:\Windows\regedit\explorer.exe	Java.exe
File created	C:\Windows\regedit\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	Java.exe
File created	C:\Windows\Tasks\conhost.exe	Java.exe
File created	C:\Windows\Tasks\088424020bedd6b28ac7fd22ee35dcd7322895ce	Java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

reg.exe8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exeWScript.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

Processes:

8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
4480	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
3320	schtasks.exe
4812	schtasks.exe
1956	schtasks.exe
3048	schtasks.exe
2660	schtasks.exe
3460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Java.exesysmon.exe

pid	Process
1744	Java.exe
5036	sysmon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Java.exesysmon.exe

description	pid	Process
Token: SeDebugPrivilege	1744	Java.exe
Token: SeDebugPrivilege	5036	sysmon.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exeWScript.execmd.exeJava.exe

description	pid	Process	procid_target
PID 2428 wrote to memory of 3228	2428	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe	87
PID 2428 wrote to memory of 3228	2428	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe	87
PID 2428 wrote to memory of 3228	2428	8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe	87
PID 3228 wrote to memory of 2328	3228	WScript.exe	91
PID 3228 wrote to memory of 2328	3228	WScript.exe	91
PID 3228 wrote to memory of 2328	3228	WScript.exe	91
PID 2328 wrote to memory of 1744	2328	cmd.exe	93
PID 2328 wrote to memory of 1744	2328	cmd.exe	93
PID 1744 wrote to memory of 5036	1744	Java.exe	101
PID 1744 wrote to memory of 5036	1744	Java.exe	101
PID 2328 wrote to memory of 4480	2328	cmd.exe	102
PID 2328 wrote to memory of 4480	2328	cmd.exe	102
PID 2328 wrote to memory of 4480	2328	cmd.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8eda5e69afffb4296509516af4e6d35b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\FCDZbiNDzDjwOG7hoSx8OUBmM.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\cVz9U.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\Java.exe
      "C:\Users\Admin\AppData\Roaming\\Roaming\java\webview\localstorage\Java.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Documents and Settings\sysmon.exe
        
        "C:\Documents and Settings\sysmon.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\regedit\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Tasks\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Documents and Settings\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\perfd00C\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\FCDZbiNDzDjwOG7hoSx8OUBmM.vbe

Filesize
223B

MD5
93405408468fb76bea37499dedd49714

SHA1
a1ecf38d3d46f706086c122df9fca3b3fd03df06

SHA256
251d2ad5c2e2da46320b0f90270f091a4999116e800d82868a57a4493e7a73bd

SHA512
e85aa92253a0dd56158549cf56c6461fbf50e628a76f089b27dd8f3e70fa970705f7c5be0eaae01ae6d3e25db636cf79cbc0be81d17417a4427ccda425c99063

Download Submit
C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\Java.exe

Filesize
1023KB

MD5
0f4c35061294cedeca25dd4e56246b2c

SHA1
f5f7cf1c9b001650f0f6bba5288648f28b01ddf4

SHA256
e73b8476bc0ee7948c953f3994081c835bf650f786602647046fdcefa7d8f4c6

SHA512
15eba2293ed1ebd861db4f904d92ca66c3a25c1b6dae7593c27cfda3af776d542b944fe3c5364a0556f5d085f0a222b4a2b93cd92f7d5b4378295c6ee6810624

Download Submit
C:\Users\Admin\AppData\Roaming\Roaming\java\webview\localstorage\cVz9U.bat

Filesize
167B

MD5
c64e03b33cae1fd0b843d923fe99ed5a

SHA1
cc0198bfd1fdcbc78425f53ed35c937ee112e2f5

SHA256
577afb170fcd975da1416321d15c1cccb43df3f71bcab611d2f9cf3a488465d5

SHA512
2a81eb0ec8a0193902ff1d38a83b40fa126233f236e7290031f20efc11f3b94718ea9f06fc00dfe6541620cc8c21d8c5ca28c930ac4e462dc2f30528f0d1f133

Download Submit
memory/1744-12-0x00007FFA1F8A3000-0x00007FFA1F8A5000-memory.dmp

Filesize
8KB

Download
memory/1744-13-0x00000000007D0000-0x00000000008D6000-memory.dmp

Filesize
1.0MB

Download
memory/5036-38-0x0000000001890000-0x000000000189C000-memory.dmp

Filesize
48KB

Download
memory/5036-40-0x00000000018A0000-0x00000000018AC000-memory.dmp

Filesize
48KB

Download
memory/5036-39-0x00000000018C0000-0x00000000018C8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads