dcrat | 94540de5569ee70fb3bd42b0d16674fbfae94c16df1991bcf0453c57d2b0be8f

General

Target

d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Size

1.7MB
MD5

d3e5eae0fe3faf65689d27d07ce9e66b
SHA1

32ec1c5784fd5fa1394e41365b47f3c3e313c91d
SHA256

94540de5569ee70fb3bd42b0d16674fbfae94c16df1991bcf0453c57d2b0be8f
SHA512

f73010d8f144f355fc7b3d65c2e92f500b7df7ec26e12e5f74a860ffdccd8ccd5ad046f1ce8a02f8c69058ce2da3244f4239f4ddb9a55f052a7847e35fac925c
SSDEEP

24576:BggmIehxUkUFjSU1I6iCLhG64+5+Nb2RUvTzD8G2wH:zGCJbGT+5+NcUvfD8G

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Prefetch\\ReadyBoot\\spoolsv.exe\", \"C:\\Windows\\System32\\shrpubw\\taskhost.exe\", \"C:\\Windows\\System32\\aclui\\spoolsv.exe\", \"C:\\Windows\\System32\\offfilt\\taskhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Prefetch\\ReadyBoot\\spoolsv.exe\", \"C:\\Windows\\System32\\shrpubw\\taskhost.exe\", \"C:\\Windows\\System32\\aclui\\spoolsv.exe\", \"C:\\Windows\\System32\\offfilt\\taskhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Windows\\System32\\SyncInfrastructure\\lsm.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Prefetch\\ReadyBoot\\spoolsv.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Prefetch\\ReadyBoot\\spoolsv.exe\", \"C:\\Windows\\System32\\shrpubw\\taskhost.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Prefetch\\ReadyBoot\\spoolsv.exe\", \"C:\\Windows\\System32\\shrpubw\\taskhost.exe\", \"C:\\Windows\\System32\\aclui\\spoolsv.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Prefetch\\ReadyBoot\\spoolsv.exe\", \"C:\\Windows\\System32\\shrpubw\\taskhost.exe\", \"C:\\Windows\\System32\\aclui\\spoolsv.exe\", \"C:\\Windows\\System32\\offfilt\\taskhost.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2096	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2096	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2096	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2096	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2096	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2096	schtasks.exe	30

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2548-3-0x00000000052B0000-0x00000000053E2000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2632	taskhost.exe

Loads dropped DLL 1 IoCs

pid	Process
2548	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\SyncInfrastructure\\lsm.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\SyncInfrastructure\\lsm.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Prefetch\\ReadyBoot\\spoolsv.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\shrpubw\\taskhost.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\shrpubw\\taskhost.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\offfilt\\taskhost.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Prefetch\\ReadyBoot\\spoolsv.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\aclui\\spoolsv.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\aclui\\spoolsv.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\offfilt\\taskhost.exe\""	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\offfilt\taskhost.exe	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\offfilt\b75386f1303e64d8139363b71e44ac16341adf4e	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SyncInfrastructure\lsm.exe	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SyncInfrastructure\101b941d020240259ca4912829b53995ad543df6	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\shrpubw\taskhost.exe	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\shrpubw\b75386f1303e64d8139363b71e44ac16341adf4e	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\aclui\spoolsv.exe	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\aclui\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3455a3da700e713f2e2529862ff	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Prefetch\ReadyBoot\spoolsv.exe	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\spoolsv.exe	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
File created	C:\Windows\Prefetch\ReadyBoot\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2856	schtasks.exe
2724	schtasks.exe
1948	schtasks.exe
2316	schtasks.exe
2332	schtasks.exe
2700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2548	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
2548	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
2548	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
2632	taskhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
Token: SeDebugPrivilege	2632	taskhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2632	2548	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe	37
PID 2548 wrote to memory of 2632	2548	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe	37
PID 2548 wrote to memory of 2632	2548	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe	37
PID 2548 wrote to memory of 2632	2548	d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d3e5eae0fe3faf65689d27d07ce9e66b_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\offfilt\taskhost.exe
  "C:\Windows\System32\offfilt\taskhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\shrpubw\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\aclui\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\offfilt\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\SyncInfrastructure\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Portable Devices\dwm.exe

Filesize
1.7MB

MD5
d3e5eae0fe3faf65689d27d07ce9e66b

SHA1
32ec1c5784fd5fa1394e41365b47f3c3e313c91d

SHA256
94540de5569ee70fb3bd42b0d16674fbfae94c16df1991bcf0453c57d2b0be8f

SHA512
f73010d8f144f355fc7b3d65c2e92f500b7df7ec26e12e5f74a860ffdccd8ccd5ad046f1ce8a02f8c69058ce2da3244f4239f4ddb9a55f052a7847e35fac925c

Download Submit
memory/2548-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x0000000000EC0000-0x0000000001080000-memory.dmp

Filesize
1.8MB

Download
memory/2548-2-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-3-0x00000000052B0000-0x00000000053E2000-memory.dmp

Filesize
1.2MB

Download
memory/2548-23-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2632-22-0x0000000000DB0000-0x0000000000F70000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads