dcrat | 6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9

General

Target

6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
Size

2.5MB
MD5

be9712de7e19243e35aa7ce6e2e23345
SHA1

ac38c04570e5cd80627c28fa9fb5be0965f0f7c6
SHA256

6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9
SHA512

5a3178d5dce31eb0f64ffa104d17a7165775acfc78efa7f459e777ea56a005152f3b424532c6736f439bde45d2fd750f72583ba631e3d49a9eb8c2c6fc6542ae
SSDEEP

49152:WnYLYb30luEfXmrkLbZZ0McjfzJ47720B4ZjYsYt54AjaTWXHtL:WnSYovmrkLbEjrJ477KZjkX4nTWXHtL

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2724	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2724	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2724	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2724	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2724	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	2724	schtasks.exe	31

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2664-1-0x0000000000C00000-0x0000000000E92000-memory.dmp	dcrat
behavioral1/files/0x000d00000001227f-24.dat	dcrat
behavioral1/memory/2736-28-0x0000000000B30000-0x0000000000DC2000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2736	dllhost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\dllhost.exe	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\dllhost.exe	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5940a34987c991	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\services.exe	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
File created	C:\Windows\Cursors\c5b4cb5e9653cc	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2560	schtasks.exe
2576	schtasks.exe
2728	schtasks.exe
2220	schtasks.exe
2608	schtasks.exe
1112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
2736	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
Token: SeDebugPrivilege	2736	dllhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2736	2664	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe	38
PID 2664 wrote to memory of 2736	2664	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe	38
PID 2664 wrote to memory of 2736	2664	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe	38

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe
"C:\Users\Admin\AppData\Local\Temp\6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2664
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\dllhost.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\dllhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Cursors\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Cursors\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\Cursors\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\dllhost.exe

Filesize
2.5MB

MD5
be9712de7e19243e35aa7ce6e2e23345

SHA1
ac38c04570e5cd80627c28fa9fb5be0965f0f7c6

SHA256
6bcef1348babeda5a1a126d6d076b2ab3bf793ec07da7aba3df963cb8ddad1b9

SHA512
5a3178d5dce31eb0f64ffa104d17a7165775acfc78efa7f459e777ea56a005152f3b424532c6736f439bde45d2fd750f72583ba631e3d49a9eb8c2c6fc6542ae

Download Submit
memory/2664-10-0x000000001A890000-0x000000001A898000-memory.dmp

Filesize
32KB

Download
memory/2664-5-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/2664-11-0x000000001A8A0000-0x000000001A8B2000-memory.dmp

Filesize
72KB

Download
memory/2664-12-0x000000001A8D0000-0x000000001A8D8000-memory.dmp

Filesize
32KB

Download
memory/2664-13-0x000000001A8E0000-0x000000001A8E8000-memory.dmp

Filesize
32KB

Download
memory/2664-7-0x0000000000BF0000-0x0000000000BF8000-memory.dmp

Filesize
32KB

Download
memory/2664-6-0x0000000002310000-0x0000000002326000-memory.dmp

Filesize
88KB

Download
memory/2664-8-0x0000000002330000-0x000000000233A000-memory.dmp

Filesize
40KB

Download
memory/2664-9-0x000000001A7C0000-0x000000001A816000-memory.dmp

Filesize
344KB

Download
memory/2664-0-0x000007FEF5473000-0x000007FEF5474000-memory.dmp

Filesize
4KB

Download
memory/2664-3-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/2664-2-0x000007FEF5470000-0x000007FEF5E5C000-memory.dmp

Filesize
9.9MB

Download
memory/2664-4-0x0000000000BC0000-0x0000000000BDC000-memory.dmp

Filesize
112KB

Download
memory/2664-14-0x000000001A8F0000-0x000000001A8FC000-memory.dmp

Filesize
48KB

Download
memory/2664-15-0x000000001A900000-0x000000001A90E000-memory.dmp

Filesize
56KB

Download
memory/2664-16-0x000000001A910000-0x000000001A91A000-memory.dmp

Filesize
40KB

Download
memory/2664-17-0x000000001ACF0000-0x000000001ACFC000-memory.dmp

Filesize
48KB

Download
memory/2664-1-0x0000000000C00000-0x0000000000E92000-memory.dmp

Filesize
2.6MB

Download
memory/2664-29-0x000007FEF5470000-0x000007FEF5E5C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-28-0x0000000000B30000-0x0000000000DC2000-memory.dmp

Filesize
2.6MB

Download
memory/2736-30-0x00000000023B0000-0x0000000002406000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads