dcrat | eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eee

General

Target

eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Size

682KB
MD5

d2cc9996ea7c592421955075590e3c90
SHA1

ada5a6d86cf1e2465c4ea578733a7ccd68881f1a
SHA256

eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eee
SHA512

600a1f55756460832c5ebac60c88d55a2f256e41f797ac6f7e265f30ca1c03b7dc98b9567ef5c9bf9fd275af6f1a4af2b43fe084430f5875ab97faed6921fe9a
SSDEEP

12288:hqnO3mwJNoGFAgHCRvp1i/fjqJRYFInDrX/xTU3JgXDV6blx1wgtra7B:h+O3mwJnCRvEMxnDVSwgY

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2792	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2792	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2792	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2792	schtasks.exe	30

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2504-1-0x0000000001370000-0x0000000001422000-memory.dmp	dcrat
behavioral1/files/0x0007000000016d72-20.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1488	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\PerfLogs\\Admin\\lsm.exe\""	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\PerfLogs\\Admin\\dwm.exe\""	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\PFRO\\explorer.exe\""	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Kno68A1\\eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe\""	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\PFRO\explorer.exe	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
File created	C:\Windows\PFRO\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
File opened for modification	C:\Windows\PFRO\RCXA690.tmp	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
File opened for modification	C:\Windows\PFRO\RCXA691.tmp	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
File opened for modification	C:\Windows\PFRO\explorer.exe	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2704	schtasks.exe
2820	schtasks.exe
2804	schtasks.exe
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2504	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
2504	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
2504	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Token: SeDebugPrivilege	1488	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1488	2504	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe	35
PID 2504 wrote to memory of 1488	2504	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe	35
PID 2504 wrote to memory of 1488	2504	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe	35

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
"C:\Users\Admin\AppData\Local\Temp\eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe"
1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2504
- C:\Users\Admin\AppData\Local\Temp\eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe
  "C:\Users\Admin\AppData\Local\Temp\eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\PerfLogs\Admin\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\PFRO\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\Kno68A1\eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eeeN.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\PerfLogs\Admin\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RCXA287.tmp

Filesize
682KB

MD5
d2cc9996ea7c592421955075590e3c90

SHA1
ada5a6d86cf1e2465c4ea578733a7ccd68881f1a

SHA256
eba55f2c36d3cea42da3a04b815fcd59469bd8ec58acf4b5a660c8c972161eee

SHA512
600a1f55756460832c5ebac60c88d55a2f256e41f797ac6f7e265f30ca1c03b7dc98b9567ef5c9bf9fd275af6f1a4af2b43fe084430f5875ab97faed6921fe9a

Download Submit
memory/2504-0-0x000007FEF5103000-0x000007FEF5104000-memory.dmp

Filesize
4KB

Download
memory/2504-1-0x0000000001370000-0x0000000001422000-memory.dmp

Filesize
712KB

Download
memory/2504-2-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2504-3-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2504-5-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/2504-4-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/2504-7-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/2504-6-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/2504-8-0x00000000002A0000-0x00000000002AC000-memory.dmp

Filesize
48KB

Download
memory/2504-72-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads