dcrat | fd5201856b63ee93c1a3e41857e7afce525967b6592c3c52d1848da634eaef3c

General

Target

adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe
Size

1.4MB
MD5

adc85d83fc17ffe2fcfe34eeab35f0e2
SHA1

a837f2267ed9eee9a981bd8448cbe1282866305b
SHA256

fd5201856b63ee93c1a3e41857e7afce525967b6592c3c52d1848da634eaef3c
SHA512

fa47b6eb1705f522a93a9fb9f19048947b07036e3d0283f88d91bef3a9f600e44e87181d404cd5b812969ab9fe9fd7b6bcb06f1fe650433e58c333ba084ccf58
SSDEEP

24576:U2G/nvxW3Ww0tq0BXRF76zMbvO0opwOb9sVuqfIfdQeFWdOCI9+4D:UbA30vbvOTdJkVKdSMEU

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat 7 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeadc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exeschtasks.exe

description	ioc	pid	Process
		300	schtasks.exe
		1108	schtasks.exe
		836	schtasks.exe
		2904	schtasks.exe
		2764	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe
		2712	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2404	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	300	2404	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2404	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2404	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2404	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2404	schtasks.exe	34

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/files/0x0008000000015cd1-9.dat	dcrat
behavioral1/memory/2804-13-0x0000000001290000-0x00000000013B2000-memory.dmp	dcrat
behavioral1/memory/2356-32-0x0000000000B40000-0x0000000000C62000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

Processes:

fontHostMonitorsavesNet.exeservices.exe

pid	Process
2804	fontHostMonitorsavesNet.exe
2356	services.exe

Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid	Process
2860	cmd.exe
2860	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fontHostMonitorsavesNet.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\krnlprov\\WmiPrvSE.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\PerfLogs\\Admin\\services.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC\\OSPPSVC.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\System32\\SubRange\\services.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Users\\Admin\\Recent\\conhost.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\taskkill\\csrss.exe\""	fontHostMonitorsavesNet.exe

Drops file in System32 directory 6 IoCs

Processes:

fontHostMonitorsavesNet.exe

description	ioc	Process
File created	C:\Windows\System32\SubRange\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\taskkill\csrss.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\taskkill\886983d96e3d3e31032c679b2d4ea91b6c05afef	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\wbem\krnlprov\WmiPrvSE.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\wbem\krnlprov\24dbde2999530ef5fd907494bc374d663924116c	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\SubRange\services.exe	fontHostMonitorsavesNet.exe

Drops file in Program Files directory 2 IoCs

Processes:

fontHostMonitorsavesNet.exe

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC\OSPPSVC.exe	fontHostMonitorsavesNet.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC\1610b97d3ab4a74cd8ae104b51bea7bfcc5b9c6f	fontHostMonitorsavesNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exeWScript.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2712	schtasks.exe
300	schtasks.exe
1108	schtasks.exe
836	schtasks.exe
2904	schtasks.exe
2764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

fontHostMonitorsavesNet.exeservices.exe

pid	Process
2804	fontHostMonitorsavesNet.exe
2804	fontHostMonitorsavesNet.exe
2804	fontHostMonitorsavesNet.exe
2356	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

fontHostMonitorsavesNet.exeservices.exe

description	pid	Process
Token: SeDebugPrivilege	2804	fontHostMonitorsavesNet.exe
Token: SeDebugPrivilege	2356	services.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exeWScript.execmd.exefontHostMonitorsavesNet.exe

description	pid	Process	procid_target
PID 2816 wrote to memory of 2792	2816	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe	30
PID 2816 wrote to memory of 2792	2816	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe	30
PID 2816 wrote to memory of 2792	2816	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe	30
PID 2816 wrote to memory of 2792	2816	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe	30
PID 2792 wrote to memory of 2860	2792	WScript.exe	31
PID 2792 wrote to memory of 2860	2792	WScript.exe	31
PID 2792 wrote to memory of 2860	2792	WScript.exe	31
PID 2792 wrote to memory of 2860	2792	WScript.exe	31
PID 2860 wrote to memory of 2804	2860	cmd.exe	33
PID 2860 wrote to memory of 2804	2860	cmd.exe	33
PID 2860 wrote to memory of 2804	2860	cmd.exe	33
PID 2860 wrote to memory of 2804	2860	cmd.exe	33
PID 2804 wrote to memory of 2356	2804	fontHostMonitorsavesNet.exe	41
PID 2804 wrote to memory of 2356	2804	fontHostMonitorsavesNet.exe	41
PID 2804 wrote to memory of 2356	2804	fontHostMonitorsavesNet.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\fontHostMonitor\feh0ZxyV3e7FSf6.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\fontHostMonitor\PwA1zMnsPP.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\fontHostMonitor\fontHostMonitorsavesNet.exe
      "C:\fontHostMonitor\fontHostMonitorsavesNet.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\PerfLogs\Admin\services.exe
        
        "C:\PerfLogs\Admin\services.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\Recent\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\taskkill\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\krnlprov\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\PerfLogs\Admin\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\SubRange\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\fontHostMonitor\PwA1zMnsPP.bat

Filesize
48B

MD5
1e53948fece6a759613e4d182f426d0f

SHA1
06f4f4212d4ac1cb3a585c6418495729530d75a2

SHA256
c449acadd920fc97bf366241ada89791300f99831a7aa6c6fde64a1e800df800

SHA512
b029e6799d936a565fc29d7e8823d1ac3bbbc873d5b8acdda21a234ba6d65496385ff43908e53f3b85fc3bcff86763d851f5dd03c25e289b706b961cecbede4d

Download Submit
C:\fontHostMonitor\feh0ZxyV3e7FSf6.vbe

Filesize
202B

MD5
cb9171302c0cd9e551de72646e89916c

SHA1
112a62c9231c1982a08923df5452ff037e46430f

SHA256
fe4ae655cd3e1dca1f54e20fc49ba01bce5a78f13400bc45700cd958e8a33dfe

SHA512
5d65b239fa3ee81c30e19df1cdeb72842688d23c254700b2cc86a87ffaf6a00e6aaf44096ade937313272c5105d0bcc29107977c690b4523f66436a61b94222e

Download Submit
\fontHostMonitor\fontHostMonitorsavesNet.exe

Filesize
1.1MB

MD5
a627f57bf0890b35f70f02ab54e868f7

SHA1
6d1f2e59fbd98b3ae808026e9ca4b00fe70b4ee8

SHA256
a95ee29f75af413547275c267c54ca69fff71ca46f0107cd9485914d070e6a98

SHA512
e33cbfcc864157b8f99bd44482be58a0dd94c612400409c0c1a3b324c51eaf3b6fed85eda30758a7505b57d544dd59b4ad3f196459ca8609451fddf88c392b97

Download Submit
memory/2356-32-0x0000000000B40000-0x0000000000C62000-memory.dmp

Filesize
1.1MB

Download
memory/2804-13-0x0000000001290000-0x00000000013B2000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads