dcrat | 1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459

General

Target

1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
Size

2.1MB
MD5

96affeab8e13743e57269977f1805472
SHA1

8935028d2abde57185acd3e1f59d831cc6ac5bc0
SHA256

1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459
SHA512

a8a1c5c302f6d51a7d390bf47ee0b4e2513498fec1081ffd2ec819133149c59c6b6bac7f6c8e7d7bd0e557c4f77f2789324cae8ccda90e1d60b3906b5d448fea
SSDEEP

49152:Cx55PUIP9xbGEfCErDBBDNvlbslAIETt1TIo3sa:klP9hAqXN6EHTj3sa

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	3484	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	3484	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	3484	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	3484	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	3484	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	3484	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	3484	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	3484	schtasks.exe	82

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/5092-1-0x0000000000C30000-0x0000000000E5C000-memory.dmp	dcrat
behavioral2/files/0x0007000000023c91-11.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe

Executes dropped EXE 1 IoCs

pid	Process
1616	explorer.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\PrintDialog\\microsoft.system.package.metadata\\Autogen\\dwm.exe\""	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Documents and Settings\\StartMenuExperienceHost.exe\""	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Windows Portable Devices\\unsecapp.exe\""	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\WindowsUpdate\\explorer.exe\""	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Documents and Settings\\OfficeClickToRun.exe\""	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\rastlsext\\dllhost.exe\""	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\PerfLogs\\StartMenuExperienceHost.exe\""	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\PerfLogs\\SppExtComObj.exe\""	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\rastlsext\dllhost.exe	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
File created	C:\Windows\System32\rastlsext\5940a34987c99120d96dace90a3f93f329dcad63	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\unsecapp.exe	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
File created	C:\Program Files\Windows Portable Devices\29c1c3cc0f76855c7e7456076a4ffc27e4947119	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\dwm.exe	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
File created	C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\6cb0b6c459d5d3455a3da700e713f2e2529862ff	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
File created	C:\Windows\WindowsUpdate\explorer.exe	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
File created	C:\Windows\WindowsUpdate\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3820	schtasks.exe
2704	schtasks.exe
1816	schtasks.exe
5028	schtasks.exe
4328	schtasks.exe
3092	schtasks.exe
2984	schtasks.exe
2320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5092	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
1616	explorer.exe
1616	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
Token: SeDebugPrivilege	1616	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1616	5092	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe	91
PID 5092 wrote to memory of 1616	5092	1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe
"C:\Users\Admin\AppData\Local\Temp\1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\WindowsUpdate\explorer.exe
  "C:\Windows\WindowsUpdate\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\PerfLogs\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\PerfLogs\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Documents and Settings\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\WindowsUpdate\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Documents and Settings\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\rastlsext\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Portable Devices\unsecapp.exe

Filesize
2.1MB

MD5
96affeab8e13743e57269977f1805472

SHA1
8935028d2abde57185acd3e1f59d831cc6ac5bc0

SHA256
1a23b06a1a5708eb5557d8ba9c15d4c4608875a9d128d358a75f2c4344081459

SHA512
a8a1c5c302f6d51a7d390bf47ee0b4e2513498fec1081ffd2ec819133149c59c6b6bac7f6c8e7d7bd0e557c4f77f2789324cae8ccda90e1d60b3906b5d448fea

Download Submit
memory/1616-38-0x0000000002200000-0x000000000220C000-memory.dmp

Filesize
48KB

Download
memory/1616-33-0x0000000000A10000-0x0000000000A18000-memory.dmp

Filesize
32KB

Download
memory/1616-42-0x00000000022C0000-0x00000000022CA000-memory.dmp

Filesize
40KB

Download
memory/1616-40-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/1616-31-0x00000000009F0000-0x00000000009FC000-memory.dmp

Filesize
48KB

Download
memory/1616-34-0x0000000000A20000-0x0000000000A2E000-memory.dmp

Filesize
56KB

Download
memory/1616-41-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/1616-35-0x0000000002270000-0x00000000022C6000-memory.dmp

Filesize
344KB

Download
memory/1616-32-0x0000000000A00000-0x0000000000A08000-memory.dmp

Filesize
32KB

Download
memory/1616-36-0x00000000021E0000-0x00000000021EA000-memory.dmp

Filesize
40KB

Download
memory/1616-37-0x00000000021F0000-0x00000000021F8000-memory.dmp

Filesize
32KB

Download
memory/1616-39-0x0000000002210000-0x0000000002218000-memory.dmp

Filesize
32KB

Download
memory/5092-0-0x00007FFFFDBF3000-0x00007FFFFDBF5000-memory.dmp

Filesize
8KB

Download
memory/5092-4-0x00007FFFFDBF0000-0x00007FFFFE6B1000-memory.dmp

Filesize
10.8MB

Download
memory/5092-30-0x00007FFFFDBF0000-0x00007FFFFE6B1000-memory.dmp

Filesize
10.8MB

Download
memory/5092-1-0x0000000000C30000-0x0000000000E5C000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads