dcrat | addb6ddd0caa7af8df2241c7e80363a4efaf9a5b5fb58ee68f56ba9df251e54e

General

Target

a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe
Size

2.3MB
MD5

a13996ce9ec70db775df5ee1c34792a4
SHA1

878ddbd0fe9445f90b4a968eabb801d34eea16a6
SHA256

addb6ddd0caa7af8df2241c7e80363a4efaf9a5b5fb58ee68f56ba9df251e54e
SHA512

6f7b32a1406973bf32902155f27a347dd46fe3022452a73a53218deb82bce940f89e70ebf90e8dfa084054bacc0306c45cc9c36b1b4ea6b9d6d0142c24dc274f
SSDEEP

49152:UbA30lmiYKzpT/IcR6Miss6OjdNXwVzZA/zY7o0VL:UbFYKzpT/76Miss6OwZ0zY7rVL

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat 10 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4808	schtasks.exe
		2572	schtasks.exe
		3352	schtasks.exe
		4796	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe
		2160	schtasks.exe
		3004	schtasks.exe
		3952	schtasks.exe
		4996	schtasks.exe
		4932	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3992	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	3992	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	3992	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	3992	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	3992	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	3992	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	3992	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	3992	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	3992	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0008000000023c69-9.dat	dcrat
behavioral2/memory/1804-13-0x0000000000100000-0x000000000030E000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	driverruntimereviewwinbroker.exe

Executes dropped EXE 2 IoCs

pid	Process
1804	driverruntimereviewwinbroker.exe
2144	lsass.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\SgrmEnclave_secure\\fontdrvhost.exe\""	driverruntimereviewwinbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\driverruntimereviewwinbroker = "\"C:\\driverruntime\\kGegedvmnVxWQ7\\driverruntimereviewwinbroker.exe\""	driverruntimereviewwinbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\driverruntimereviewwinbroker = "\"C:\\driverruntime\\driverruntimereviewwinbroker\\driverruntimereviewwinbroker.exe\""	driverruntimereviewwinbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\PerfLogs\\sysmon.exe\""	driverruntimereviewwinbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\TpmTasks\\dllhost.exe\""	driverruntimereviewwinbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Documents and Settings\\lsass.exe\""	driverruntimereviewwinbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\driverruntime\\driverruntimereviewwinbroker\\StartMenuExperienceHost.exe\""	driverruntimereviewwinbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\ProgramData\\Start Menu\\System.exe\""	driverruntimereviewwinbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\Microsoft.Graphics.Display.DisplayEnhancementService\\dllhost.exe\""	driverruntimereviewwinbroker.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\System32\SgrmEnclave_secure\fontdrvhost.exe	driverruntimereviewwinbroker.exe
File created	C:\Windows\System32\SgrmEnclave_secure\5b884080fd4f94e2695da25c503f9e33b9605b83	driverruntimereviewwinbroker.exe
File created	C:\Windows\System32\Microsoft.Graphics.Display.DisplayEnhancementService\dllhost.exe	driverruntimereviewwinbroker.exe
File created	C:\Windows\System32\Microsoft.Graphics.Display.DisplayEnhancementService\5940a34987c99120d96dace90a3f93f329dcad63	driverruntimereviewwinbroker.exe
File created	C:\Windows\System32\TpmTasks\dllhost.exe	driverruntimereviewwinbroker.exe
File created	C:\Windows\System32\TpmTasks\5940a34987c99120d96dace90a3f93f329dcad63	driverruntimereviewwinbroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4796	schtasks.exe
4996	schtasks.exe
2160	schtasks.exe
2572	schtasks.exe
3004	schtasks.exe
4932	schtasks.exe
4808	schtasks.exe
3952	schtasks.exe
3352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1804	driverruntimereviewwinbroker.exe
1804	driverruntimereviewwinbroker.exe
1804	driverruntimereviewwinbroker.exe
1804	driverruntimereviewwinbroker.exe
1804	driverruntimereviewwinbroker.exe
1804	driverruntimereviewwinbroker.exe
2144	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	driverruntimereviewwinbroker.exe
Token: SeDebugPrivilege	2144	lsass.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3500	1444	a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe	82
PID 1444 wrote to memory of 3500	1444	a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe	82
PID 1444 wrote to memory of 3500	1444	a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe	82
PID 3500 wrote to memory of 996	3500	WScript.exe	90
PID 3500 wrote to memory of 996	3500	WScript.exe	90
PID 3500 wrote to memory of 996	3500	WScript.exe	90
PID 996 wrote to memory of 1804	996	cmd.exe	92
PID 996 wrote to memory of 1804	996	cmd.exe	92
PID 1804 wrote to memory of 2144	1804	driverruntimereviewwinbroker.exe	104
PID 1804 wrote to memory of 2144	1804	driverruntimereviewwinbroker.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a13996ce9ec70db775df5ee1c34792a4_JaffaCakes118.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\driverruntime\kGegedvmnVxWQ7.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\driverruntime\E5Fjb70.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\driverruntime\driverruntimereviewwinbroker.exe
      "C:\driverruntime\driverruntimereviewwinbroker.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1804
    - - C:\Documents and Settings\lsass.exe
        
        "C:\Documents and Settings\lsass.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\SgrmEnclave_secure\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\Microsoft.Graphics.Display.DisplayEnhancementService\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "driverruntimereviewwinbroker" /sc ONLOGON /tr "'C:\driverruntime\kGegedvmnVxWQ7\driverruntimereviewwinbroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "driverruntimereviewwinbroker" /sc ONLOGON /tr "'C:\driverruntime\driverruntimereviewwinbroker\driverruntimereviewwinbroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\PerfLogs\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\TpmTasks\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Documents and Settings\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\driverruntime\driverruntimereviewwinbroker\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\driverruntime\E5Fjb70.bat

Filesize
51B

MD5
eaa874ab241fd40826c737c1a3b0f3df

SHA1
f2f41d0951603bf869076eae8c0d98a11a44c297

SHA256
3f0b3977d065cc7ec8939745001b7dc67cfc3f34b7e87e1d54478e6e213fa82f

SHA512
4956b8bb8baa3f64ca0436a6974f719e656afb1b520dcd40eb6242eaba52d4031fe50e1eaf24db51925d28aaad4e52f3b61c2969d356703b1729c2be72b50913

Download Submit
C:\driverruntime\driverruntimereviewwinbroker.exe

Filesize
2.0MB

MD5
809f43c8c299a2a92ed90b1219bc65cd

SHA1
bba32b8296f00bb6cb296e964bcf6e73e143960f

SHA256
be64d2d039a35aabc97ce277fa748c50ecf2ca6a622bc9421f966cd4497575ba

SHA512
43f5aabe4ef8039aec9ffe7f05c5f6e235e781090651b7a6d71201e4407bf065e4b9c9b604c28dc3087003acb1f9d686a99fc95d7ceed18c5e7d45a43512e065

Download Submit
C:\driverruntime\kGegedvmnVxWQ7.vbe

Filesize
197B

MD5
6903e32ae281e0929a77ca0339c585b7

SHA1
f4a28ed3827b4d1fe6ff42909fd2f7203757e0b9

SHA256
251069df82e17fb9d7c769958e87940b998cd0466569fc12f1ace1016d369b84

SHA512
942f37450e56ddf350b365d3efaf554ad0cfa04db97e3c1906a707ca2877453f2d390c5c455b650158db6d3c9b8862ea1aca21f00188a842768b4dab1080e8aa

Download Submit
memory/1804-12-0x00007FFDEEC63000-0x00007FFDEEC65000-memory.dmp

Filesize
8KB

Download
memory/1804-13-0x0000000000100000-0x000000000030E000-memory.dmp

Filesize
2.1MB

Download
memory/2144-45-0x000000001BB70000-0x000000001BB7C000-memory.dmp

Filesize
48KB

Download
memory/2144-46-0x000000001BB90000-0x000000001BB9C000-memory.dmp

Filesize
48KB

Download
memory/2144-47-0x000000001D200000-0x000000001D256000-memory.dmp

Filesize
344KB

Download
memory/2144-48-0x000000001BB80000-0x000000001BB8A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads