dcrat | 8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c

General

Target

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Size

682KB
MD5

054590792d65d5db6a5270d6ad965b93
SHA1

bd04bb88a8ee09284e3e0eba53677f6b999d1b46
SHA256

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c
SHA512

818e9a0ee0fa54874b811cd6fd5f61fc014508c84ec8f09f4d53b52a1f12a15a1b1cc516c35189352bc328c2cde659f969dfc6741b1319ba91689a2a19dce07e
SSDEEP

12288:RqnO3mwJNoGFAgHCRvp1i/fjqJRYFInDrX/xTU3JgXDV6blx1wgtra7B:R+O3mwJnCRvEMxnDVSwgY

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	3828	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	3828	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	3828	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	3828	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	3828	schtasks.exe	85

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/2112-1-0x0000000000440000-0x00000000004F2000-memory.dmp	dcrat
behavioral2/files/0x0007000000023c98-17.dat	dcrat
behavioral2/files/0x000a000000023c8a-32.dat	dcrat
behavioral2/files/0x000b000000023c86-43.dat	dcrat
behavioral2/files/0x000b000000023c8e-78.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Executes dropped EXE 1 IoCs

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

pid	Process
2508	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\KBDFTHRK\\dllhost.exe\""	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c = "\"C:\\Users\\All Users\\SoftwareDistribution\\8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe\""	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\InputMethod\\CHS\\smss.exe\""	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\""	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\ProgramData\\Package Cache\\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\\dwm.exe\""	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Drops file in System32 directory 5 IoCs

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	ioc	Process
File created	C:\Windows\System32\KBDFTHRK\dllhost.exe	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File created	C:\Windows\System32\KBDFTHRK\5940a34987c99120d96dace90a3f93f329dcad63	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File opened for modification	C:\Windows\System32\KBDFTHRK\RCXBED2.tmp	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File opened for modification	C:\Windows\System32\KBDFTHRK\RCXBED3.tmp	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File opened for modification	C:\Windows\System32\KBDFTHRK\dllhost.exe	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Drops file in Program Files directory 1 IoCs

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\explorer.exe	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Drops file in Windows directory 10 IoCs

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	ioc	Process
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\22eafd247d37c30fed3795ee41d259ec72bb351c	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File created	C:\Windows\InputMethod\CHS\69ddcba757bf72f7d36c464c71f42baab150b2b9	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\RCXBA2B.tmp	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File opened for modification	C:\Windows\InputMethod\CHS\smss.exe	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File created	C:\Windows\InputMethod\CHS\smss.exe	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\RCXB9BD.tmp	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File opened for modification	C:\Windows\InputMethod\CHS\RCXC2DD.tmp	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
File opened for modification	C:\Windows\InputMethod\CHS\RCXC34B.tmp	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
1404	schtasks.exe
976	schtasks.exe
1248	schtasks.exe
4476	schtasks.exe
3476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

pid	Process
2112	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	pid	Process
Token: SeDebugPrivilege	2112	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Token: SeDebugPrivilege	2508	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	pid	Process	procid_target
PID 2112 wrote to memory of 2508	2112	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe	91
PID 2112 wrote to memory of 2508	2112	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe	91

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
"C:\Users\Admin\AppData\Local\Temp\8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2112
- C:\Users\Admin\AppData\Local\Temp\8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe
  "C:\Users\Admin\AppData\Local\Temp\8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDFTHRK\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\dwm.exe

Filesize
682KB

MD5
a1b4da376bad2ebfde5a085941626ae1

SHA1
569fb3f7036148cb15fd8937c25e8439a189d7f7

SHA256
d837358e0c3656d5b29b19681019ae2ac98e831ac9b68543a5766e1234eac26b

SHA512
5dffb5e6f8eb1a45950095b39fcebfcb620dd150885b6c219911324a83160ec69836adc282a871daf5263c00bb7ccf6bf48ed878c28987364aa385cce0ca4842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c.exe.log

Filesize
1KB

MD5
b7c0c43fc7804baaa7dc87152cdc9554

SHA1
1bab62bd56af745678d4e967d91e1ccfdeed4038

SHA256
46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457

SHA512
9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769

Download Submit
C:\Windows\InputMethod\CHS\smss.exe

Filesize
682KB

MD5
054590792d65d5db6a5270d6ad965b93

SHA1
bd04bb88a8ee09284e3e0eba53677f6b999d1b46

SHA256
8b0b1728b6bcac3675b0e14ec262c061252bb9be0ac121d4342ac790ac96d51c

SHA512
818e9a0ee0fa54874b811cd6fd5f61fc014508c84ec8f09f4d53b52a1f12a15a1b1cc516c35189352bc328c2cde659f969dfc6741b1319ba91689a2a19dce07e

Download Submit
C:\Windows\InputMethod\CHS\smss.exe

Filesize
682KB

MD5
a3b3f664ae12cb2d93a5fc3a4fd59276

SHA1
aa79cd65c8d694aa71d21bd73a9d6cd225b274d5

SHA256
793e2c0a9bde540a4f412503228873bb72b074b5cdbc25ba8c4441012043e032

SHA512
ad334c6f515d83c23134a61a76ef475d56af780b8d9d471018e171f17e4bd455ee70aab0df4a8870a3a157f9e075039e01d5b5c1a6b47e37de8b871e80174a97

Download Submit
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe

Filesize
682KB

MD5
f531b91f39a6bb4f5359cc6ecd77ae34

SHA1
2ff409886001fa7bd5b91cefdb1243db48da07d9

SHA256
24eb11beb1377896c5581709321262edf4a5cd982db55a11af6ba35cd210d1ca

SHA512
e3bad4880b20e31f13289242313400933c3110c5970e82c452edc1178e5afaab7b4aeb4e527c5e7a572a139e950ce8a0deecc23c5fe7540361491a3a74410366

Download Submit
memory/2112-3-0x0000000002670000-0x000000000267C000-memory.dmp

Filesize
48KB

Download
memory/2112-6-0x00000000026A0000-0x00000000026AA000-memory.dmp

Filesize
40KB

Download
memory/2112-7-0x00000000026B0000-0x00000000026B8000-memory.dmp

Filesize
32KB

Download
memory/2112-8-0x000000001B0B0000-0x000000001B0BC000-memory.dmp

Filesize
48KB

Download
memory/2112-4-0x0000000002680000-0x000000000268C000-memory.dmp

Filesize
48KB

Download
memory/2112-5-0x00007FF9DC8D0000-0x00007FF9DD391000-memory.dmp

Filesize
10.8MB

Download
memory/2112-0-0x00007FF9DC8D3000-0x00007FF9DC8D5000-memory.dmp

Filesize
8KB

Download
memory/2112-2-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/2112-84-0x00007FF9DC8D0000-0x00007FF9DD391000-memory.dmp

Filesize
10.8MB

Download
memory/2112-1-0x0000000000440000-0x00000000004F2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads