dcrat | 4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323

General

Target

4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe
Size

924KB
MD5

e44a6dd4f61c4c3138fc1c81f13ce0a9
SHA1

a8479aee1b3e22cd059cf38b3110d69a5504102b
SHA256

4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323
SHA512

ec423fe26d7e9a7a726bbbfe2d7dd7c0235c6bc3111e795d0d99b4ee76b453d1e548bd943e29ee7d607a7f39ed8f78f20ae5885d77f8e6db35607806616b3219
SSDEEP

12288:aRZ+IoG/n9IQxW3OBsee2X+t4RboqnOH0qhDD2hBM5biqZUAu09SwRRpfcg:U2G/nvxW3Ww0to+OHt7iefRpft

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	3596	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	3596	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	3596	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3596	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	3596	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	3596	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	3596	schtasks.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/4568-13-0x0000000000880000-0x0000000000920000-memory.dmp	dcrat
C:\Users\Admin\AppData\Local\Temp\SessionHostmonitorNet\SessionHostmonitorNetsavesHost.exe	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exeWScript.exeSessionHostmonitorNetsavesHost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SessionHostmonitorNetsavesHost.exe

Executes dropped EXE 2 IoCs

Processes:

SessionHostmonitorNetsavesHost.exewinlogon.exe

pid process

4568 SessionHostmonitorNetsavesHost.exe
452 winlogon.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

SessionHostmonitorNetsavesHost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\assembly\\GAC\\Extensibility\\RuntimeBroker.exe\""	SessionHostmonitorNetsavesHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SessionHostmonitorNetsavesHost = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SessionHostmonitorNet\\t3VXd\\SessionHostmonitorNetsavesHost.exe\""	SessionHostmonitorNetsavesHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\DevModeRunAsUserConfig\\taskhostw.exe\""	SessionHostmonitorNetsavesHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\All Users\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\""	SessionHostmonitorNetsavesHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Documents and Settings\\winlogon.exe\""	SessionHostmonitorNetsavesHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Documents and Settings\\csrss.exe\""	SessionHostmonitorNetsavesHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Media Player\\Media Renderer\\dllhost.exe\""	SessionHostmonitorNetsavesHost.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com

flow	ioc
14	ip-api.com

Drops file in System32 directory 2 IoCs

Processes:

SessionHostmonitorNetsavesHost.exe

description	ioc	process
File created	C:\Windows\System32\DevModeRunAsUserConfig\taskhostw.exe	SessionHostmonitorNetsavesHost.exe
File created	C:\Windows\System32\DevModeRunAsUserConfig\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	SessionHostmonitorNetsavesHost.exe

Drops file in Program Files directory 3 IoCs

Processes:

SessionHostmonitorNetsavesHost.exe

description	ioc	process
File created	C:\Program Files\ModifiableWindowsApps\dwm.exe	SessionHostmonitorNetsavesHost.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\dllhost.exe	SessionHostmonitorNetsavesHost.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\5940a34987c99120d96dace90a3f93f329dcad63	SessionHostmonitorNetsavesHost.exe

Drops file in Windows directory 2 IoCs

Processes:

SessionHostmonitorNetsavesHost.exe

description	ioc	process
File created	C:\Windows\assembly\GAC\Extensibility\RuntimeBroker.exe	SessionHostmonitorNetsavesHost.exe
File created	C:\Windows\assembly\GAC\Extensibility\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	SessionHostmonitorNetsavesHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exeWScript.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

Processes:

SessionHostmonitorNetsavesHost.exe4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SessionHostmonitorNetsavesHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4060 schtasks.exe
1780 schtasks.exe
1536 schtasks.exe
3952 schtasks.exe
4836 schtasks.exe
2688 schtasks.exe
2908 schtasks.exe

pid	process
4060	schtasks.exe
1780	schtasks.exe
1536	schtasks.exe
3952	schtasks.exe
4836	schtasks.exe
2688	schtasks.exe
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

SessionHostmonitorNetsavesHost.exewinlogon.exe

pid	process
4568	SessionHostmonitorNetsavesHost.exe
4568	SessionHostmonitorNetsavesHost.exe
4568	SessionHostmonitorNetsavesHost.exe
4568	SessionHostmonitorNetsavesHost.exe
452	winlogon.exe
452	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SessionHostmonitorNetsavesHost.exewinlogon.exe

description pid process

Token: SeDebugPrivilege 4568 SessionHostmonitorNetsavesHost.exe
Token: SeDebugPrivilege 452 winlogon.exe

description	pid	process
Token: SeDebugPrivilege	4568	SessionHostmonitorNetsavesHost.exe
Token: SeDebugPrivilege	452	winlogon.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exeWScript.execmd.exeSessionHostmonitorNetsavesHost.execmd.exe

description	pid	process	target process
PID 2972 wrote to memory of 2924	2972	4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe	WScript.exe
PID 2972 wrote to memory of 2924	2972	4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe	WScript.exe
PID 2972 wrote to memory of 2924	2972	4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe	WScript.exe
PID 2924 wrote to memory of 1700	2924	WScript.exe	cmd.exe
PID 2924 wrote to memory of 1700	2924	WScript.exe	cmd.exe
PID 2924 wrote to memory of 1700	2924	WScript.exe	cmd.exe
PID 1700 wrote to memory of 4568	1700	cmd.exe	SessionHostmonitorNetsavesHost.exe
PID 1700 wrote to memory of 4568	1700	cmd.exe	SessionHostmonitorNetsavesHost.exe
PID 4568 wrote to memory of 4100	4568	SessionHostmonitorNetsavesHost.exe	cmd.exe
PID 4568 wrote to memory of 4100	4568	SessionHostmonitorNetsavesHost.exe	cmd.exe
PID 4100 wrote to memory of 2516	4100	cmd.exe	w32tm.exe
PID 4100 wrote to memory of 2516	4100	cmd.exe	w32tm.exe
PID 4100 wrote to memory of 452	4100	cmd.exe	winlogon.exe
PID 4100 wrote to memory of 452	4100	cmd.exe	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe
"C:\Users\Admin\AppData\Local\Temp\4003b5df5836f6ce600e34bb1471180d392df97d8bf451512ccb55a7545fb323.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SessionHostmonitorNet\mLzymvMiirrQOXPEyjXJ5QZUzTtHfO.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SessionHostmonitorNet\t3VXd.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\SessionHostmonitorNet\SessionHostmonitorNetsavesHost.exe
      "C:\Users\Admin\AppData\Local\Temp\SessionHostmonitorNet\SessionHostmonitorNetsavesHost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OPD9L51RjU.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4100
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2516
      - C:\Documents and Settings\winlogon.exe
        
        "C:\Documents and Settings\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Documents and Settings\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Media Renderer\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\assembly\GAC\Extensibility\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SessionHostmonitorNetsavesHost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\SessionHostmonitorNet\t3VXd\SessionHostmonitorNetsavesHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\DevModeRunAsUserConfig\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OPD9L51RjU.bat

Filesize
202B

MD5
796bbde23addcfc17606e60f3e5d4db3

SHA1
af64354a3562de0d41155dbc7801c4f41902d4f4

SHA256
1bb57bd3d7643963115600c57f689c270c64001d682f6b89fea996fe2e46cfc8

SHA512
d88044aba6913771a8b7abe8d4a1d9b14fc46a7e0582d3a720c2c0810d5e62a4438ca217197387344ecab4b018c804f3e4dd9939a7f6c7322fa1b2a68067e9fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\SessionHostmonitorNet\SessionHostmonitorNetsavesHost.exe

Filesize
615KB

MD5
e915469eca8f027672aedc6241ab4ea4

SHA1
4a28d6a2eafad121f47c118866da6ee9de2a6829

SHA256
f086f15de0d2fba478956f12f96d5a5f11f7ad0048a3ea694d226e062f4b99cf

SHA512
5889f84f0043c293dd74f5d8e859575317a93a823ccd1b7295dd70e7d1ea4354b282da7c69692e37de797fde705118455232244acba2f64d22d28172fd6a22db

Download Submit
C:\Users\Admin\AppData\Local\Temp\SessionHostmonitorNet\mLzymvMiirrQOXPEyjXJ5QZUzTtHfO.vbe

Filesize
207B

MD5
fe43d6574e51bfef72c4cdc63b217db5

SHA1
4f0e06ab9c15cf1aa385b6ab773d308c6e334d9d

SHA256
6c29dd00d17230a1bc450d51e2387cf502fd33956e661a8adee8057c19a6d7dc

SHA512
053e00973ba2f04ff3db1b33f9129288123c5ba209c8c28082d111607bdb599dad385db881d7898e45826a455d35fabc396b1925d31359066a5924e339162a11

Download Submit
C:\Users\Admin\AppData\Local\Temp\SessionHostmonitorNet\t3VXd.bat

Filesize
65B

MD5
3d340aff29db3e924132c091f33d802b

SHA1
58c02b709a43b3548227fac0765e706cdbb2f5a7

SHA256
931b38c3661c01a98f5e0c1a1723d846b32bf3911a2780e5398994605dde3c41

SHA512
afbe5c7647bd758aaf625859988b0e4166b36db48890acae768f9d795d3497a289b4fb427dacef09872b99006652f4b0ab03bf42bd27612e89f4b3917684b5a1

Download Submit
memory/452-39-0x00000000027B0000-0x00000000027BC000-memory.dmp

Filesize
48KB

Download
memory/452-40-0x0000000002780000-0x000000000278C000-memory.dmp

Filesize
48KB

Download
memory/452-41-0x00000000027C0000-0x00000000027C8000-memory.dmp

Filesize
32KB

Download
memory/452-42-0x00000000027F0000-0x00000000027FA000-memory.dmp

Filesize
40KB

Download
memory/452-38-0x0000000002770000-0x000000000277C000-memory.dmp

Filesize
48KB

Download
memory/452-37-0x0000000002740000-0x000000000274C000-memory.dmp

Filesize
48KB

Download
memory/4568-13-0x0000000000880000-0x0000000000920000-memory.dmp

Filesize
640KB

Download
memory/4568-12-0x00007FFE6CEC3000-0x00007FFE6CEC5000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads