dcrat | 8daf7dcdf256d7de40d33e5550dc5e8bbf887b8c4b7f49c79a15c96dad867f82

General

Target

F4620C0AFA8E21897509B2E7215097F5.exe
Size

2.1MB
MD5

f4620c0afa8e21897509b2e7215097f5
SHA1

af216ca6105e271a3fb45a23c10ee7cf3158b7e1
SHA256

8daf7dcdf256d7de40d33e5550dc5e8bbf887b8c4b7f49c79a15c96dad867f82
SHA512

68b875acc06d9c3796f49377b5b25a5e8b9a380221eea59e4274249ca7d2bff10c3fc5edf50eae5da726afea882e0e777af86af25be7b57c8fbfd70448d8d7dd
SSDEEP

49152:IBJz3c6UY0hj8eu32ILwfhNE5I6OrLCXLdsN6:yh3cvY0Z8pGWwfhyxOrUsN6

Score

10^/10

dcrat discovery infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	1956	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	1956	schtasks.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Medal.exeF4620C0AFA8E21897509B2E7215097F5.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Medal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	F4620C0AFA8E21897509B2E7215097F5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

Processes:

Medal.exesihost.exe

pid process

3556 Medal.exe
3264 sihost.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 4 IoCs

Processes:

Medal.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Defender\sihost.exe	Medal.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\sihost.exe	Medal.exe
File created	C:\Program Files (x86)\Windows Defender\66fc9ff0ee96c2	Medal.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\SppExtComObj.exe	Medal.exe

Drops file in Windows directory 2 IoCs

Processes:

Medal.exe

description ioc process

File created C:\Windows\es-ES\dllhost.exe Medal.exe
File created C:\Windows\es-ES\5940a34987c991 Medal.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\es-ES\dllhost.exe	Medal.exe
File created	C:\Windows\es-ES\5940a34987c991	Medal.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

F4620C0AFA8E21897509B2E7215097F5.exeWScript.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F4620C0AFA8E21897509B2E7215097F5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

Processes:

F4620C0AFA8E21897509B2E7215097F5.exeMedal.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	F4620C0AFA8E21897509B2E7215097F5.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	Medal.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1756	schtasks.exe
1240	schtasks.exe
4540	schtasks.exe
3340	schtasks.exe
1872	schtasks.exe
3268	schtasks.exe
1932	schtasks.exe
4036	schtasks.exe
5060	schtasks.exe
5016	schtasks.exe
872	schtasks.exe
412	schtasks.exe
4748	schtasks.exe
4812	schtasks.exe
1748	schtasks.exe
2936	schtasks.exe
1056	schtasks.exe
1636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Medal.exe

pid	process
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe
3556	Medal.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

sihost.exe

pid process

3264 sihost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Medal.exesihost.exe

description pid process

Token: SeDebugPrivilege 3556 Medal.exe
Token: SeDebugPrivilege 3264 sihost.exe

pid	process
3264	sihost.exe

description	pid	process
Token: SeDebugPrivilege	3556	Medal.exe
Token: SeDebugPrivilege	3264	sihost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

F4620C0AFA8E21897509B2E7215097F5.exeWScript.execmd.exeMedal.execmd.exe

description	pid	process	target process
PID 1800 wrote to memory of 4088	1800	F4620C0AFA8E21897509B2E7215097F5.exe	WScript.exe
PID 1800 wrote to memory of 4088	1800	F4620C0AFA8E21897509B2E7215097F5.exe	WScript.exe
PID 1800 wrote to memory of 4088	1800	F4620C0AFA8E21897509B2E7215097F5.exe	WScript.exe
PID 4088 wrote to memory of 372	4088	WScript.exe	cmd.exe
PID 4088 wrote to memory of 372	4088	WScript.exe	cmd.exe
PID 4088 wrote to memory of 372	4088	WScript.exe	cmd.exe
PID 372 wrote to memory of 3556	372	cmd.exe	Medal.exe
PID 372 wrote to memory of 3556	372	cmd.exe	Medal.exe
PID 3556 wrote to memory of 4544	3556	Medal.exe	cmd.exe
PID 3556 wrote to memory of 4544	3556	Medal.exe	cmd.exe
PID 4544 wrote to memory of 3212	4544	cmd.exe	chcp.com
PID 4544 wrote to memory of 3212	4544	cmd.exe	chcp.com
PID 4544 wrote to memory of 3516	4544	cmd.exe	w32tm.exe
PID 4544 wrote to memory of 3516	4544	cmd.exe	w32tm.exe
PID 4544 wrote to memory of 3264	4544	cmd.exe	sihost.exe
PID 4544 wrote to memory of 3264	4544	cmd.exe	sihost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\F4620C0AFA8E21897509B2E7215097F5.exe
"C:\Users\Admin\AppData\Local\Temp\F4620C0AFA8E21897509B2E7215097F5.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Medal\LziQ5Qlyzu0f0C5NtfHJq0w.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Medal\Fua65ZRdZNJ5OJAqSXb7513NtPonCq4dK3Ubpg1B.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Medal\Medal.exe
      "C:\Medal/Medal.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0xJHwtMs9r.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3212
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3516
      - C:\Users\Default\Pictures\sihost.exe
        
        "C:\Users\Default\Pictures\sihost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Medal\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Medal\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Medal\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Pictures\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Pictures\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Pictures\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MedalM" /sc MINUTE /mo 5 /tr "'C:\Medal\Medal.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Medal" /sc ONLOGON /tr "'C:\Medal\Medal.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MedalM" /sc MINUTE /mo 10 /tr "'C:\Medal\Medal.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Medal\Fua65ZRdZNJ5OJAqSXb7513NtPonCq4dK3Ubpg1B.bat

Filesize
63B

MD5
e24619181276af563705f4b1bed29490

SHA1
fddac27290319f69543f5330fe97c122a8a01376

SHA256
eee937e02edcd36de3ed7658c9ad9d79844502c8553a7c244b2b154aa9ffec05

SHA512
1898a5e2a52f2f34466dfd9e1b1149b36052874b6be432dd9301ecfa6bc3a964dca6980b8db54ddcf8ef24a95792efcaffeb09aceb7a04304a0d18f4d0ce0591

Download Submit
C:\Medal\LziQ5Qlyzu0f0C5NtfHJq0w.vbe

Filesize
224B

MD5
96d43070e1e39d421c53a2f8dca13fc6

SHA1
07417cccceddbf8d5f5b48dec0b2e08d53a4754f

SHA256
0dab986e5c533631946e27cdbb5147e68b9eb3008c1add60d21a59cd7d964314

SHA512
9fc0ee5ac42bca7c7ee7584baa5be6907fc750378d037d56e075a21c4fe8eaeb3efac3e9fb6087a70a6ad01dcebf05d2462f2463daa8063b4047c11e5364d398

Download Submit
C:\Medal\Medal.exe

Filesize
1.8MB

MD5
4f66bbfed3a524398bd0267ed974ccbc

SHA1
b2567397dc823412d87a23428c7833ff74586b7d

SHA256
fa05b7f28eb1df0447998b89a08aa96453b0f3240c31489900d178862eaa80d8

SHA512
bc4de61adb5f56c66043a2617ebfcc9f4e82d36e48dbdc9178695f9466d554eb364d69829490ff43100e8cb457ce7e78b2e277a3cf1733edf32c0154e6f56d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\0xJHwtMs9r.bat

Filesize
212B

MD5
62f4626dee97d6a132531dd51899fc18

SHA1
fdac13f3405cb6d72d0a538b3dc238fbf438d9b8

SHA256
7cdc11911e74a066aed08ebcd89bcbd8cacb179937f3aeb55891730dde320138

SHA512
bba4bc2c1fa132c0079b50ce69d20eb16833da4d563f852d344260d654e7b54bda2bb41c953d933e84e897f2c3e9ff49100c3069f064488a3b30d188c729d8c0

Download Submit
memory/3264-48-0x000000001DB80000-0x000000001DC4D000-memory.dmp

Filesize
820KB

Download
memory/3556-17-0x000000001B650000-0x000000001B66C000-memory.dmp

Filesize
112KB

Download
memory/3556-15-0x000000001B280000-0x000000001B28E000-memory.dmp

Filesize
56KB

Download
memory/3556-18-0x000000001B6C0000-0x000000001B710000-memory.dmp

Filesize
320KB

Download
memory/3556-20-0x000000001B670000-0x000000001B688000-memory.dmp

Filesize
96KB

Download
memory/3556-22-0x000000001B630000-0x000000001B63E000-memory.dmp

Filesize
56KB

Download
memory/3556-39-0x000000001B950000-0x000000001BA1D000-memory.dmp

Filesize
820KB

Download
memory/3556-13-0x0000000000530000-0x000000000070E000-memory.dmp

Filesize
1.9MB

Download
memory/3556-12-0x00007FFD81563000-0x00007FFD81565000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads