dcrat | c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627

General

Target

c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
Size

973KB
MD5

0f03b3a0ca9a75f7b900a4e773020ec0
SHA1

1a952a87fb4e476eb9e111cee8d355e57426aadd
SHA256

c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627
SHA512

f243a27db37556c220032d2f6612193c4577f998e17a35ea9260cd942ff9211d5e12ffa4de8794081b3edd5e789206c147f2d2b9a16ddd82e2fd7b4b8247c6e7
SSDEEP

12288:nhhBMuext92N3cit1RGJV/H0uQ1PjmzBd5EBy10cgZMc29ZxasnLlDD:n5E92NRzO/UFdmBchH29Zsg9

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	1676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	1676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	1676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	1676	schtasks.exe	83

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe

Executes dropped EXE 1 IoCs

pid	Process
3300	SppExtComObj.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\ipconfig\\sihost.exe\""	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\notepad\\explorer.exe\""	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\ProvSysprep\\dllhost.exe\""	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\SppExtComObj.exe\""	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ipconfig\RCXB597.tmp	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File opened for modification	C:\Windows\System32\ipconfig\sihost.exe	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File created	C:\Windows\System32\ProvSysprep\dllhost.exe	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File opened for modification	C:\Windows\System32\ProvSysprep\dllhost.exe	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File created	C:\Windows\System32\ProvSysprep\5940a34987c991	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File created	C:\Windows\System32\ipconfig\sihost.exe	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File created	C:\Windows\System32\ipconfig\66fc9ff0ee96c2	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File opened for modification	C:\Windows\System32\ProvSysprep\RCXB0A4.tmp	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\taskhostw.exe	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\notepad\explorer.exe	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File created	C:\Windows\notepad\7a0fd90576e088	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File opened for modification	C:\Windows\notepad\RCXB79C.tmp	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
File opened for modification	C:\Windows\notepad\explorer.exe	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2708	schtasks.exe
1056	schtasks.exe
3256	schtasks.exe
1328	schtasks.exe
972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4572	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
4572	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
4572	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
Token: SeDebugPrivilege	3300	SppExtComObj.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1748	4572	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe	90
PID 4572 wrote to memory of 1748	4572	c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe	90
PID 1748 wrote to memory of 4132	1748	cmd.exe	92
PID 1748 wrote to memory of 4132	1748	cmd.exe	92
PID 1748 wrote to memory of 3300	1748	cmd.exe	94
PID 1748 wrote to memory of 3300	1748	cmd.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe
"C:\Users\Admin\AppData\Local\Temp\c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6mkMy7kpoU.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4132
- - C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\SppExtComObj.exe
    "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\SppExtComObj.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\ProvSysprep\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\ipconfig\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\notepad\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\SppExtComObj.exe

Filesize
973KB

MD5
bb495300283ef0b17f7b87d61720cce6

SHA1
b5fdb4c2ee2380f73ef824980524431d1b02507c

SHA256
b61c2dd541931d1268d53ab5ae2548507dff72ea0971fab20b92922f0f4fc7c0

SHA512
702ba71faf3085f950b9c8684626b96b2374ae9c619f6c6f346097d3aa0f101d3f4a9e5106e70b5bddb6ae7a3d5bf46f85cc020e036b260cc8fd372eee66b2c6

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
973KB

MD5
0f03b3a0ca9a75f7b900a4e773020ec0

SHA1
1a952a87fb4e476eb9e111cee8d355e57426aadd

SHA256
c98996c31b4e223beb8d807100536c6c8dc19ec50a10365d893fa00b270f4627

SHA512
f243a27db37556c220032d2f6612193c4577f998e17a35ea9260cd942ff9211d5e12ffa4de8794081b3edd5e789206c147f2d2b9a16ddd82e2fd7b4b8247c6e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\6mkMy7kpoU.bat

Filesize
265B

MD5
5f5b120e86531bc87ec78dc46225890f

SHA1
93a5d77c923b09271e3518a0998876c549ca8897

SHA256
1ce3d9c05689069a2a5c2b663bdb38f47964579b54eeb66ba7223c67960614ef

SHA512
abf737e972d25cc70d84ff3d509ffa8f9db30e2e5177d2d9b91abae40ebefbdc3de946168f53267eeb36fa54f27a787f9148f228b378fa26518ee2fe3f810e23

Download Submit
memory/3300-63-0x0000000000DF0000-0x0000000000EEA000-memory.dmp

Filesize
1000KB

Download
memory/4572-6-0x0000000002770000-0x000000000277C000-memory.dmp

Filesize
48KB

Download
memory/4572-5-0x0000000002760000-0x000000000276C000-memory.dmp

Filesize
48KB

Download
memory/4572-0-0x00007FFF769F3000-0x00007FFF769F5000-memory.dmp

Filesize
8KB

Download
memory/4572-7-0x000000001B1D0000-0x000000001B1D8000-memory.dmp

Filesize
32KB

Download
memory/4572-3-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Filesize
32KB

Download
memory/4572-58-0x00007FFF769F0000-0x00007FFF774B1000-memory.dmp

Filesize
10.8MB

Download
memory/4572-4-0x0000000002750000-0x0000000002760000-memory.dmp

Filesize
64KB

Download
memory/4572-2-0x00007FFF769F0000-0x00007FFF774B1000-memory.dmp

Filesize
10.8MB

Download
memory/4572-1-0x0000000000320000-0x000000000041A000-memory.dmp

Filesize
1000KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads