dcrat | 6ac3d59d497f8e48d23d023b308bb2bc2d524e37c0175849cfead05c96e097af

General

Target

9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
Size

654KB
MD5

9aec290016ad674b1809b9359b200689
SHA1

6865e7cb350b1456c85db787797487901b8b22f8
SHA256

6ac3d59d497f8e48d23d023b308bb2bc2d524e37c0175849cfead05c96e097af
SHA512

2e4ae500367adbd3bff927bdd3a843cf7bab2c2c8d2a41d215109dde42b8e2d9c250bedef42cd8733fb599111682351615b72b9baf686725dda338ea426b5aca
SSDEEP

12288:NqnO1RR3IiZDFN7/lFTSvejX9n/RXQaXYNPtBWa:N+O1DZFB/laeBpc

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2180-1-0x00000000009F0000-0x0000000000A9A000-memory.dmp	dcrat
behavioral2/files/0x0007000000023c9a-11.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3148	lsass.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\SetNetworkLocation\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
File created	C:\Windows\System32\SetNetworkLocation\lsass.exe	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\SetNetworkLocation\lsass.exe	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\5b884080fd4f94e2695da25c503f9e33b9605b83	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\upfc.exe	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\ea1d8f6d871115e19e634087152e4aa43b875a69	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ImmersiveControlPanel\fr-FR\sysmon.exe	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2684	schtasks.exe
3060	schtasks.exe
620	schtasks.exe
4856	schtasks.exe
2848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
3148	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
Token: SeDebugPrivilege	3148	lsass.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3060	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	83
PID 2180 wrote to memory of 3060	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	83
PID 2180 wrote to memory of 620	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	85
PID 2180 wrote to memory of 620	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	85
PID 2180 wrote to memory of 4856	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	87
PID 2180 wrote to memory of 4856	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	87
PID 2180 wrote to memory of 2848	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	89
PID 2180 wrote to memory of 2848	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	89
PID 2180 wrote to memory of 2684	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	91
PID 2180 wrote to memory of 2684	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	91
PID 2180 wrote to memory of 3148	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	93
PID 2180 wrote to memory of 3148	2180	9aec290016ad674b1809b9359b200689_JaffaCakes118.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9aec290016ad674b1809b9359b200689_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9aec290016ad674b1809b9359b200689_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\SetNetworkLocation\lsass.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3060
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:620
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\PerfLogs\dwm.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4856
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\upfc.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2848
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\Music\SppExtComObj.exe'" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2684
- C:\Windows\System32\SetNetworkLocation\lsass.exe
  "C:\Windows\System32\SetNetworkLocation\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Music\SppExtComObj.exe

Filesize
654KB

MD5
9aec290016ad674b1809b9359b200689

SHA1
6865e7cb350b1456c85db787797487901b8b22f8

SHA256
6ac3d59d497f8e48d23d023b308bb2bc2d524e37c0175849cfead05c96e097af

SHA512
2e4ae500367adbd3bff927bdd3a843cf7bab2c2c8d2a41d215109dde42b8e2d9c250bedef42cd8733fb599111682351615b72b9baf686725dda338ea426b5aca

Download Submit
memory/2180-0-0x00007FFDDEDD3000-0x00007FFDDEDD5000-memory.dmp

Filesize
8KB

Download
memory/2180-1-0x00000000009F0000-0x0000000000A9A000-memory.dmp

Filesize
680KB

Download
memory/2180-2-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download
memory/2180-24-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads