dcrat | 7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd

General

Target

7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
Size

1017KB
MD5

d3c5eed3ff2e208576288da3caf4feb7
SHA1

5405262345f60c37eec11c8731f163069137864f
SHA256

7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd
SHA512

b67c12670cd42b816d2be8d6524c8b6122e8b239ff2f006c799f94daa4c9f4eafb24f91bd7208db3c94db926afcc7fbfd05f87f03201f567132984923e38e899
SSDEEP

12288:FWS8z4eYDr/0fAhZRFABcwTiEJad8KZyc2nS1hYLcS4nQsMPd7XSeD6vGaI1qn4M:FWSK6H0fMGcwzJsZZyLwvn2V7nDki+4M

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	1564	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	1564	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	1564	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1564	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	1564	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	1564	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	1564	schtasks.exe	30

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2088-1-0x0000000001220000-0x0000000001326000-memory.dmp	dcrat
behavioral1/files/0x0005000000019427-11.dat	dcrat
behavioral1/memory/2684-23-0x0000000001340000-0x0000000001446000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2684	spoolsv.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\joy\\spoolsv.exe\""	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\mfc100jpn\\dwm.exe\""	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\lsm.exe\""	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\PerfLogs\\Admin\\lsass.exe\""	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\davhlpr\\spoolsv.exe\""	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Public\\services.exe\""	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\Tasks\\explorer.exe\""	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\System32\davhlpr\spoolsv.exe	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
File created	C:\Windows\System32\davhlpr\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
File created	C:\Windows\System32\joy\spoolsv.exe	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
File created	C:\Windows\System32\joy\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
File created	C:\Windows\System32\mfc100jpn\dwm.exe	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
File created	C:\Windows\System32\mfc100jpn\6cb0b6c459d5d3455a3da700e713f2e2529862ff	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorer.exe	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
File created	C:\Windows\Tasks\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2648	schtasks.exe
2632	schtasks.exe
1856	schtasks.exe
2320	schtasks.exe
2752	schtasks.exe
2720	schtasks.exe
2668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2088	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
2088	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
2088	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
2088	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
2088	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
2684	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
Token: SeDebugPrivilege	2684	spoolsv.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2684	2088	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe	38
PID 2088 wrote to memory of 2684	2088	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe	38
PID 2088 wrote to memory of 2684	2088	7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe
"C:\Users\Admin\AppData\Local\Temp\7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\System32\davhlpr\spoolsv.exe
  "C:\Windows\System32\davhlpr\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\PerfLogs\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\davhlpr\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Tasks\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\joy\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\mfc100jpn\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\explorer.exe

Filesize
1017KB

MD5
d3c5eed3ff2e208576288da3caf4feb7

SHA1
5405262345f60c37eec11c8731f163069137864f

SHA256
7b62293bc123569809bdf209855dfdcfb1c155295e1284ebe500a737267547dd

SHA512
b67c12670cd42b816d2be8d6524c8b6122e8b239ff2f006c799f94daa4c9f4eafb24f91bd7208db3c94db926afcc7fbfd05f87f03201f567132984923e38e899

Download Submit
memory/2088-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/2088-1-0x0000000001220000-0x0000000001326000-memory.dmp

Filesize
1.0MB

Download
memory/2088-2-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2088-25-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2684-23-0x0000000001340000-0x0000000001446000-memory.dmp

Filesize
1.0MB

Download
memory/2684-24-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/2684-26-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads