dcrat | 6ac3d59d497f8e48d23d023b308bb2bc2d524e37c0175849cfead05c96e097af

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
Size

654KB
MD5

9aec290016ad674b1809b9359b200689
SHA1

6865e7cb350b1456c85db787797487901b8b22f8
SHA256

6ac3d59d497f8e48d23d023b308bb2bc2d524e37c0175849cfead05c96e097af
SHA512

2e4ae500367adbd3bff927bdd3a843cf7bab2c2c8d2a41d215109dde42b8e2d9c250bedef42cd8733fb599111682351615b72b9baf686725dda338ea426b5aca
SSDEEP

12288:NqnO1RR3IiZDFN7/lFTSvejX9n/RXQaXYNPtBWa:N+O1DZFB/laeBpc

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2196-1-0x0000000000B50000-0x0000000000BFA000-memory.dmp	dcrat
behavioral1/files/0x000500000001868b-11.dat	dcrat
behavioral1/memory/2948-23-0x00000000003D0000-0x000000000047A000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2948	lsass.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\usbmon\lsass.exe	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
File created	C:\Windows\System32\usbmon\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
File created	C:\Windows\System32\AppIdPolicyEngineApi\winlogon.exe	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
File created	C:\Windows\System32\AppIdPolicyEngineApi\cc11b995f2a76da408ea6a601e682e64743153ad	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2564	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2564	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
792	schtasks.exe
2672	schtasks.exe
2772	schtasks.exe
2864	schtasks.exe
2660	schtasks.exe
2788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
2948	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
Token: SeDebugPrivilege	2948	lsass.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 792	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	32
PID 2196 wrote to memory of 792	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	32
PID 2196 wrote to memory of 792	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	32
PID 2196 wrote to memory of 2672	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	34
PID 2196 wrote to memory of 2672	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	34
PID 2196 wrote to memory of 2672	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	34
PID 2196 wrote to memory of 2772	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	36
PID 2196 wrote to memory of 2772	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	36
PID 2196 wrote to memory of 2772	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	36
PID 2196 wrote to memory of 2864	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	38
PID 2196 wrote to memory of 2864	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	38
PID 2196 wrote to memory of 2864	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	38
PID 2196 wrote to memory of 2660	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	40
PID 2196 wrote to memory of 2660	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	40
PID 2196 wrote to memory of 2660	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	40
PID 2196 wrote to memory of 2788	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	42
PID 2196 wrote to memory of 2788	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	42
PID 2196 wrote to memory of 2788	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	42
PID 2196 wrote to memory of 2592	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	44
PID 2196 wrote to memory of 2592	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	44
PID 2196 wrote to memory of 2592	2196	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	44
PID 2592 wrote to memory of 2540	2592	cmd.exe	46
PID 2592 wrote to memory of 2540	2592	cmd.exe	46
PID 2592 wrote to memory of 2540	2592	cmd.exe	46
PID 2592 wrote to memory of 2564	2592	cmd.exe	47
PID 2592 wrote to memory of 2564	2592	cmd.exe	47
PID 2592 wrote to memory of 2564	2592	cmd.exe	47
PID 2592 wrote to memory of 2948	2592	cmd.exe	48
PID 2592 wrote to memory of 2948	2592	cmd.exe	48
PID 2592 wrote to memory of 2948	2592	cmd.exe	48

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9aec290016ad674b1809b9359b200689_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:792
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2672
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2772
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\usbmon\lsass.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2864
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\AppIdPolicyEngineApi\winlogon.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2660
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cAkxiZYK5r.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2540
- - C:\Windows\system32\PING.EXE
    ping -n 5 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2564
- - C:\Users\Default User\lsass.exe
    "C:\Users\Default User\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cAkxiZYK5r.bat

Filesize
197B

MD5
0a15cd521ea53da8e1543bcb698422d4

SHA1
92adfac5f23b222e56f47640963da494544122a0

SHA256
962993201a15d676901a50d620cb5f67bd310f15f4de368ff3cdee17456e882e

SHA512
84ff358b03d5f5af425be602c5adf280622907406907447e4335534aac9bb965ea258e77d00169754f6d577fbcef9b3376814f8361067e3802d6fdcafd452de7

Download Submit
C:\Windows\System32\AppIdPolicyEngineApi\winlogon.exe

Filesize
654KB

MD5
9aec290016ad674b1809b9359b200689

SHA1
6865e7cb350b1456c85db787797487901b8b22f8

SHA256
6ac3d59d497f8e48d23d023b308bb2bc2d524e37c0175849cfead05c96e097af

SHA512
2e4ae500367adbd3bff927bdd3a843cf7bab2c2c8d2a41d215109dde42b8e2d9c250bedef42cd8733fb599111682351615b72b9baf686725dda338ea426b5aca

Download Submit
memory/2196-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmp

Filesize
4KB

Download
memory/2196-1-0x0000000000B50000-0x0000000000BFA000-memory.dmp

Filesize
680KB

Download
memory/2196-2-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/2196-20-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-23-0x00000000003D0000-0x000000000047A000-memory.dmp

Filesize
680KB

Download