dcrat | b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04

General

Target

b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
Size

912KB
MD5

ce162876a4c72ca0da4b96a16a5833ac
SHA1

c1e7998c66f153719672bbd1e7fe6103a12869c2
SHA256

b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04
SHA512

1fe9474a4bfd6a4a74f8e4db88e4719ad6b1aa0a4efafc12e29a207ebc969284c96a276ad06e44ccd91f8f260f7e076c4b1a8d4504dd0ebd0d9017dbde1c4cd6
SSDEEP

24576:Sa3x1VStiA7iw63VboDAJDyL+qq+aWTIN+4e:Rswq63IEUj

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2888	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2888	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2888	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2888	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2888	schtasks.exe	30

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2800-1-0x00000000002E0000-0x00000000003CC000-memory.dmp	dcrat
behavioral1/files/0x0005000000019234-11.dat	dcrat
behavioral1/memory/3064-19-0x0000000000E70000-0x0000000000F5C000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3064	spoolsv.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ProgramData\\Desktop\\csrss.exe\""	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\ProgramData\\Desktop\\spoolsv.exe\""	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Public\\Music\\Sample Music\\WmiPrvSE.exe\""	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\explorer.exe\""	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\KBDYCL\\dllhost.exe\""	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\KBDYCL\dllhost.exe	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
File created	C:\Windows\System32\KBDYCL\5940a34987c99120d96dace90a3f93f329dcad63	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\CSC\v2.0.6\wininit.exe	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2196	schtasks.exe
2928	schtasks.exe
2168	schtasks.exe
2932	schtasks.exe
1908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2800	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
2800	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
2800	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
3064	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
Token: SeDebugPrivilege	3064	spoolsv.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 3064	2800	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe	36
PID 2800 wrote to memory of 3064	2800	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe	36
PID 2800 wrote to memory of 3064	2800	b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe
"C:\Users\Admin\AppData\Local\Temp\b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\ProgramData\Desktop\spoolsv.exe
  "C:\ProgramData\Desktop\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\ProgramData\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\ProgramData\Desktop\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDYCL\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\KBDYCL\dllhost.exe

Filesize
912KB

MD5
ce162876a4c72ca0da4b96a16a5833ac

SHA1
c1e7998c66f153719672bbd1e7fe6103a12869c2

SHA256
b868e4ba796b5bb6cbf37136fa41fb1cdb4c4ac05187b11df98c05b053b51e04

SHA512
1fe9474a4bfd6a4a74f8e4db88e4719ad6b1aa0a4efafc12e29a207ebc969284c96a276ad06e44ccd91f8f260f7e076c4b1a8d4504dd0ebd0d9017dbde1c4cd6

Download Submit
memory/2800-0-0x000007FEF5883000-0x000007FEF5884000-memory.dmp

Filesize
4KB

Download
memory/2800-1-0x00000000002E0000-0x00000000003CC000-memory.dmp

Filesize
944KB

Download
memory/2800-2-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2800-20-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/3064-19-0x0000000000E70000-0x0000000000F5C000-memory.dmp

Filesize
944KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads