dcrat | bb7131d57c39a57b3e35acc18093a76c932a889c592fe2843eb4065ec8b646f0

Analysis

max time kernel
551s
max time network
597s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-12-2024 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCRatBuild.exe
Size

1.9MB
MD5

1ee8448fea979c3ecbd21141a0ea84ef
SHA1

f19958c4e816d94b10d7787ce693251d7c93a16f
SHA256

bb7131d57c39a57b3e35acc18093a76c932a889c592fe2843eb4065ec8b646f0
SHA512

941c038b15068362aec2efb174a324d88566fc7013c2659fbbee4e3f41073b9a50772b45e93a144e178c110b065369d7140fbf5c299221d301c9216066ac5ba7
SSDEEP

24576:2TbBv5rUyXVKhCwi/IrsiTqwhFplFG8P1eI8qzvJ0C0wjZ1xjzj9fIXVIgeTryO2:IBJMVXFG89X8qzhfN1xD9QXVIgeTr7iN

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	portsurrogate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	portsurrogate.exe

Executes dropped EXE 3 IoCs

pid	Process
1068	portsurrogate.exe
4232	portsurrogate.exe
3924	Catch me.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\TableTextService\en-US\9e8d7a4ca61bd9	portsurrogate.exe
File created	C:\Program Files\Windows Portable Devices\sysmon.exe	portsurrogate.exe
File created	C:\Program Files\Windows Portable Devices\121e5b5079f7c0	portsurrogate.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\StartMenuExperienceHost.exe	portsurrogate.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\55b276f4edf653	portsurrogate.exe
File created	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	portsurrogate.exe
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9	portsurrogate.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe	portsurrogate.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Catch me.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2156	PING.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings	portsurrogate.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings	portsurrogate.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2156	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
1068	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe
4232	portsurrogate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4232	portsurrogate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	portsurrogate.exe
Token: SeDebugPrivilege	4232	portsurrogate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1764	mspaint.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1764	mspaint.exe
1764	mspaint.exe
1764	mspaint.exe
1764	mspaint.exe
3924	Catch me.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 3720	3120	DCRatBuild.exe	80
PID 3120 wrote to memory of 3720	3120	DCRatBuild.exe	80
PID 3120 wrote to memory of 3720	3120	DCRatBuild.exe	80
PID 3720 wrote to memory of 4788	3720	WScript.exe	89
PID 3720 wrote to memory of 4788	3720	WScript.exe	89
PID 3720 wrote to memory of 4788	3720	WScript.exe	89
PID 4788 wrote to memory of 1068	4788	cmd.exe	91
PID 4788 wrote to memory of 1068	4788	cmd.exe	91
PID 1068 wrote to memory of 3524	1068	portsurrogate.exe	92
PID 1068 wrote to memory of 3524	1068	portsurrogate.exe	92
PID 3524 wrote to memory of 4616	3524	cmd.exe	94
PID 3524 wrote to memory of 4616	3524	cmd.exe	94
PID 3524 wrote to memory of 2156	3524	cmd.exe	95
PID 3524 wrote to memory of 2156	3524	cmd.exe	95
PID 3524 wrote to memory of 4232	3524	cmd.exe	97
PID 3524 wrote to memory of 4232	3524	cmd.exe	97
PID 4232 wrote to memory of 1764	4232	portsurrogate.exe	98
PID 4232 wrote to memory of 1764	4232	portsurrogate.exe	98
PID 4232 wrote to memory of 3924	4232	portsurrogate.exe	102
PID 4232 wrote to memory of 3924	4232	portsurrogate.exe	102
PID 4232 wrote to memory of 3924	4232	portsurrogate.exe	102
PID 4232 wrote to memory of 3020	4232	portsurrogate.exe	103
PID 4232 wrote to memory of 3020	4232	portsurrogate.exe	103

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Containerbroker\lKOMtCPL4q4SacgMeC7cXhP8ahbvPWguTV.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Containerbroker\BhHu3cOSeq1FnFNHV6w5d9GBhXYpDdXk5OtvWMmGHkL6BT20n5qn40Hh.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Containerbroker\portsurrogate.exe
      "C:\Containerbroker/portsurrogate.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gLerBnat3T.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3524
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4616
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2156
      - C:\Containerbroker\portsurrogate.exe
        
        "C:\Containerbroker\portsurrogate.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\system32\mspaint.exe
        
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\голый.jpg"
        7⤵
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Catch me.exe
        
        "C:\Users\Admin\AppData\Local\Catch me.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3924
        
        C:\Windows\System32\shutdown.exe
        
        "C:\Windows\System32\shutdown.exe"
        7⤵
        
        PID:3020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Containerbroker\BhHu3cOSeq1FnFNHV6w5d9GBhXYpDdXk5OtvWMmGHkL6BT20n5qn40Hh.bat

Filesize
98B

MD5
fd5e33ad0c2bf4e91f2a7deded611b86

SHA1
90d7127257f68dc76fd9747c9898a7c2ba5a0cfc

SHA256
afaa21d706fdc3d86d851861deb016c3de2e865bdea8e0be9ae67e6b1f10420b

SHA512
e849701be2703330c32cbaf0bd5fe02a8eb13b763563a6b262a2e327baf5b8424811a70e6df47395f5cafdba1f710a3d32bf724cd7bd720b8d9b0303250c609e

Download Submit
C:\Containerbroker\lKOMtCPL4q4SacgMeC7cXhP8ahbvPWguTV.vbe

Filesize
250B

MD5
a87ac73f766078fed72e240a824940e5

SHA1
79877cdebf53a7c1ef9b361e9656ec4c364f206e

SHA256
a5d1d9718f09b6d13105d5a1a561512609762f4b9d204efaf7e0cfe466871469

SHA512
4f7f92c41b31a8bcc89b2fafee9efa46ea65ae6da6c74379eb3be98f060dcb2a3237687e1083d79df78e669cb28431cfdcdb7f0189bff169e43b222a230dd220

Download Submit
C:\Containerbroker\portsurrogate.exe

Filesize
1.6MB

MD5
041176338487edefef14877b1e2050d5

SHA1
945f5005db47d433fbdabb599ca2790710f0a056

SHA256
e1b7ce41ce5f12fb9466fcb9cf687e82883547d6f2c21480fcb7408b9e315fdb

SHA512
292f43151ce11b81f096127a9c7d131f423f96f5b31fa54a72c1e4800180837cdf369a7480ed397a18be2fc6803face50ffee172c07ef0a8f9b82793f8b40145

Download Submit
C:\Users\Admin\AppData\Local\Catch me.exe

Filesize
24KB

MD5
4df86625da5b0dddbfea4ef5359224fa

SHA1
6903529cd2982db69e3feca486ac2386b10ed6b8

SHA256
419ab7aa44c1071066c94e861d508bc7c3751a2e1a495a0369304ac350d5fac7

SHA512
0ab04bb00b8f06fda2f7227661411e4f05553cbc36032c4be8841db6b8e8274efd5348eb4175d9811ba0b244fcd493a7c63d9776920c0164364fe54524ffa8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\portsurrogate.exe.log

Filesize
1KB

MD5
d122c86f83bcdee42ff6f17de46ad0bd

SHA1
ba64c5e17a98b2df6d6855d7a88c4f397e355ff7

SHA256
1a58a1467e73d956c2ab19ddade6f8fb33feca2cda5a719ff457091a5e0a733d

SHA512
943716fa00a8deaec14ea5e1fbb82882e8aff5eeae28d82b6fdffc44a821c47d30cd31dec01e7c2c746d8b4582b392f35d24dba732ef06a51dc738308c012455

Download Submit
C:\Users\Admin\AppData\Local\Temp\gLerBnat3T.bat

Filesize
164B

MD5
3d41fe3b8ce6b7b73e50fb4a5626ac2b

SHA1
5e37986e382c7fe9f598c1ec85ad08a9e8cfc688

SHA256
7a92572962bc9800cc2388fd98062f1fd89357bcb9b3a1e042c8799674b78d8c

SHA512
ac2164b2060fda737961bd2c364c8c3b1e56b99fe408d013c399cc02acc45a69c04104434f5945f86b2dcb55febceb2befbb99bec4848d7b6c07fdb23d69da10

Download Submit
C:\Users\Admin\AppData\Local\голый.jpg

Filesize
30KB

MD5
396d6a420daa8e11f9a2dfbc9223daf1

SHA1
f28bc6a3513a6b4f6346424d625aa17e5025de6e

SHA256
df6eb59da66d46faae55dd4d6373c97326b10f214bf231db78e4715109068e6b

SHA512
b1ab5ffaac35356daa0d9ad3fa01030e60d2276225af25d6a183dc1b0526c87a37c4a671fea3d634111bc83bf823db94130b2ea1de6e52a08b1f6a84fd72c58b

Download Submit
memory/1068-15-0x00007FFF5D4F3000-0x00007FFF5D4F5000-memory.dmp

Filesize
8KB

Download
memory/1068-16-0x0000000000520000-0x00000000006B8000-memory.dmp

Filesize
1.6MB

Download
memory/4232-37-0x000000001CA10000-0x000000001CA1E000-memory.dmp

Filesize
56KB

Download
memory/4232-39-0x0000000002A00000-0x0000000002A12000-memory.dmp

Filesize
72KB

Download
memory/4232-42-0x00000000029F0000-0x0000000002A00000-memory.dmp

Filesize
64KB

Download
memory/4232-35-0x000000001D0E0000-0x000000001D13A000-memory.dmp

Filesize
360KB

Download