dcrat | f395305daac1c6e8fd577b85bc9132b5358c9e4c4b818b61f76d50d2477a3906

General

Target
DCRatBuild.exe
Size 1.1MB
Sample241123-bkh6lsznap
SHA256 f395305daac1c6e8fd577b85bc9132b5358c9e4c4b818b61f76d50d2477a3906
MD5 a92e55e04cc2026f53c97bdf0e91f6ba
SHA1 a31af958d3f885e0f55465acc214bdb0d56e672f
SHA512 441ca291ccc66f16b5252d65c23fb9f0a57f242ca35f196f41175e2c4d3adc436b026111b79fb4c77db9dbe6370e837133c1d02e571730831293e0a1ffeb95a9
SSDEEP 24576:U2G/nvxW3Ww0t43eblFYt2e9esxtDyVjD7D1NauFd3YP+ow7d:UbA3042rejxtDydhcQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3820	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	3820	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	3820	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	3820	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	3820	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	3820	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	3820	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	3820	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	240	3820	schtasks.exe	84

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral3/files/0x001a00000002aac4-10.dat	dcrat
behavioral3/memory/1712-13-0x00000000007C0000-0x0000000000896000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
1712	portperf.exe
4856	csrss.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\csrss.exe	portperf.exe
File created	C:\Windows\Fonts\886983d96e3d3e	portperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	portperf.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3996	schtasks.exe
1892	schtasks.exe
3780	schtasks.exe
1512	schtasks.exe
3896	schtasks.exe
2500	schtasks.exe
4140	schtasks.exe
1596	schtasks.exe
240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1712	portperf.exe
1712	portperf.exe
1712	portperf.exe
4856	csrss.exe
4856	csrss.exe
4856	csrss.exe
4856	csrss.exe
4856	csrss.exe
4856	csrss.exe
4856	csrss.exe
4856	csrss.exe
4856	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4856	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	portperf.exe
Token: SeDebugPrivilege	4856	csrss.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3164	5032	DCRatBuild.exe	80
PID 5032 wrote to memory of 3164	5032	DCRatBuild.exe	80
PID 5032 wrote to memory of 3164	5032	DCRatBuild.exe	80
PID 3164 wrote to memory of 3060	3164	WScript.exe	81
PID 3164 wrote to memory of 3060	3164	WScript.exe	81
PID 3164 wrote to memory of 3060	3164	WScript.exe	81
PID 3060 wrote to memory of 1712	3060	cmd.exe	83
PID 3060 wrote to memory of 1712	3060	cmd.exe	83
PID 1712 wrote to memory of 5056	1712	portperf.exe	94
PID 1712 wrote to memory of 5056	1712	portperf.exe	94
PID 5056 wrote to memory of 1444	5056	cmd.exe	96
PID 5056 wrote to memory of 1444	5056	cmd.exe	96
PID 5056 wrote to memory of 4856	5056	cmd.exe	97
PID 5056 wrote to memory of 4856	5056	cmd.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ChainBlocksurrogateagentFont\IQYI1ZQqki4.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ChainBlocksurrogateagentFont\qVwtNBtq7doCC7qZCII8cJUJd.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\ChainBlocksurrogateagentFont\portperf.exe
      "C:\ChainBlocksurrogateagentFont\portperf.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y8nE0hKGnf.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5056
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1444
      - C:\Windows\Fonts\csrss.exe
        
        "C:\Windows\Fonts\csrss.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Fonts\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Documents\My Music\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\My Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IQYI1ZQqki4.vbe

Path C:\ChainBlocksurrogateagentFont\IQYI1ZQqki4.vbe
Size 230B
SHA256 01543751a00db2bbbaaf366aa712303363c484c1f9970ae04857f6703473a5e2
MD5 b3e0630669e9f81b3e57048e6af1e015
SHA1 650473dc5a9144a544fb53af84ef4fc8e0a72320
SHA512 ac7e7fdf1fb92273a08e030d9f4b407faa4b759c85932a7a2463df92f83f5bb7b596b9d8b2e0acea1a20305903f4e425e7a82edf4f12c9ca60c56f67bca1236f
MD5 SHA1 SHA512

Submit Download

portperf.exe

Path C:\ChainBlocksurrogateagentFont\portperf.exe
Size 829KB
SHA256 4b6302643800dafe4629960e243ba26663f8510c42f4eaf656b1cc510406e408
MD5 a054982f7e12c1f491eccd25d9c1b5d7
SHA1 b3c78b1c7c8a95486db06e39f56910d0f3e90996
SHA512 d57be5af22f21e7c20d330f5714ddcf1936152e3d9bd2254c1a2c83f420bfe183ae204c871b1ce2d8f5361a1661afbe39a9b5bec12fb00195a8c0b967977a925
SSDEEP 24576:b3eblFYt2e9esxtDyVjD7D1NauFd3YP+ow7:b2rejxtDydhc
MD5 SHA1 SHA512 SSDEEP

Submit Download

qVwtNBtq7doCC7qZCII8cJUJd.bat

Path C:\ChainBlocksurrogateagentFont\qVwtNBtq7doCC7qZCII8cJUJd.bat
Size 46B
SHA256 5f60a9046ff7978e0518ad160509409a8818dbea53faa79c5d93364dd8d70f95
MD5 00afe3a3fcc7952dfadc97502a3aecac
SHA1 6b7e7835cd437e437c91ad91255efe5c8f24c0f4
SHA512 9af6ecb3ff68382c633e640d29e86d17597faa2ab712f75697bdf98596c6b17146991ec88fd94df8c65a8fa6ae60e763a66747cf0be4ae37d60beb1e8ff87cc3
MD5 SHA1 SHA512

Submit Download

Y8nE0hKGnf.bat

Path C:\Users\Admin\AppData\Local\Temp\Y8nE0hKGnf.bat
Size 191B
SHA256 a3576023084c8ca331ed28d715616c1aeb3690818c25cffbc3d468fd35c8e712
MD5 3fb9c99ec1d8762880bc06ed22ba6332
SHA1 fdd6274b2312b95ad18615f9dd267a911707fb30
SHA512 5c91ea3b7de80d7db1bc44f1aae8c735086c0c1df6b838ba804269b136e89f3d2e71951405cf9b4a15058d4dbd7fc4d635883f70e8a4af06874dfa937f4613a4
MD5 SHA1 SHA512

Submit Download

memory/1712-12-0x00007FFB234E3000-0x00007FFB234E5000-memory.dmp

Download

memory/1712-13-0x00000000007C0000-0x0000000000896000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads