dcrat | e4a958444e72eb1b3be02f3a8bf29044a81f328405a4969a4f66515ef219774e

Analysis

max time kernel
121s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E7870CD0C30A52066C454C15A5A5A2F5.exe
Size

3.5MB
MD5

e7870cd0c30a52066c454c15a5a5a2f5
SHA1

fc64203e05c104a116e7e4c354c9ee77c99737d6
SHA256

e4a958444e72eb1b3be02f3a8bf29044a81f328405a4969a4f66515ef219774e
SHA512

3e0a40959eaba1fbf3cb7a11707bc658421f3066e4e1beea56088ac213c10524127d4d9e2500e549a1ee608887c113973892d54fb91fae6ea9db4eb9e818bebe
SSDEEP

98304:sALvAvoV3JDBQSBK5f7a6uBt9iofavIa:smvvV5DpQ7a6ugoCvI

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Executes dropped EXE 1 IoCs

pid	Process
2684	Idle.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\fr-FR\24dbde2999530e	E7870CD0C30A52066C454C15A5A5A2F5.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\WmiPrvSE.exe	E7870CD0C30A52066C454C15A5A5A2F5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\WmiPrvSE.exe	E7870CD0C30A52066C454C15A5A5A2F5.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\24dbde2999530e	E7870CD0C30A52066C454C15A5A5A2F5.exe
File created	C:\Program Files\Windows Sidebar\Idle.exe	E7870CD0C30A52066C454C15A5A5A2F5.exe
File created	C:\Program Files\Windows Sidebar\6ccacd8608530f	E7870CD0C30A52066C454C15A5A5A2F5.exe
File created	C:\Program Files (x86)\Windows Sidebar\fr-FR\WmiPrvSE.exe	E7870CD0C30A52066C454C15A5A5A2F5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\Idle.exe	E7870CD0C30A52066C454C15A5A5A2F5.exe
File created	C:\Windows\Cursors\6ccacd8608530f	E7870CD0C30A52066C454C15A5A5A2F5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
1528	E7870CD0C30A52066C454C15A5A5A2F5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	E7870CD0C30A52066C454C15A5A5A2F5.exe
Token: SeDebugPrivilege	2684	Idle.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2908	1528	E7870CD0C30A52066C454C15A5A5A2F5.exe	30
PID 1528 wrote to memory of 2908	1528	E7870CD0C30A52066C454C15A5A5A2F5.exe	30
PID 1528 wrote to memory of 2908	1528	E7870CD0C30A52066C454C15A5A5A2F5.exe	30
PID 2908 wrote to memory of 2968	2908	cmd.exe	32
PID 2908 wrote to memory of 2968	2908	cmd.exe	32
PID 2908 wrote to memory of 2968	2908	cmd.exe	32
PID 2908 wrote to memory of 2656	2908	cmd.exe	33
PID 2908 wrote to memory of 2656	2908	cmd.exe	33
PID 2908 wrote to memory of 2656	2908	cmd.exe	33
PID 2908 wrote to memory of 2684	2908	cmd.exe	34
PID 2908 wrote to memory of 2684	2908	cmd.exe	34
PID 2908 wrote to memory of 2684	2908	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\E7870CD0C30A52066C454C15A5A5A2F5.exe
"C:\Users\Admin\AppData\Local\Temp\E7870CD0C30A52066C454C15A5A5A2F5.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9dcINziU22.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2968
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2656
- - C:\Program Files\Windows Sidebar\Idle.exe
    "C:\Program Files\Windows Sidebar\Idle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Sidebar\fr-FR\WmiPrvSE.exe

Filesize
3.5MB

MD5
e7870cd0c30a52066c454c15a5a5a2f5

SHA1
fc64203e05c104a116e7e4c354c9ee77c99737d6

SHA256
e4a958444e72eb1b3be02f3a8bf29044a81f328405a4969a4f66515ef219774e

SHA512
3e0a40959eaba1fbf3cb7a11707bc658421f3066e4e1beea56088ac213c10524127d4d9e2500e549a1ee608887c113973892d54fb91fae6ea9db4eb9e818bebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\9dcINziU22.bat

Filesize
217B

MD5
cbee526867f350f8749e38931db2e5bc

SHA1
6ffa3bd4754dcac040a9c6bcbc7391f0657f5b2a

SHA256
1df73ff4b77499ae8a2ecfdf53caad67dbcd2c949967ff90d1de64a99cb2b18d

SHA512
0b3c5dc2a271d3f4f571b00ab393390f2daaafeee9864d8b2d9649cc9114b921749558b581c891326cb542b60e5469a8942d07866d4aa9772e187b7353edb6fd

Download Submit
memory/1528-19-0x0000000000A40000-0x0000000000A58000-memory.dmp

Filesize
96KB

Download
memory/1528-73-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-4-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-13-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-6-0x00000000009D0000-0x00000000009F6000-memory.dmp

Filesize
152KB

Download
memory/1528-8-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-12-0x0000000000A20000-0x0000000000A3C000-memory.dmp

Filesize
112KB

Download
memory/1528-10-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/1528-17-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-16-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-23-0x000007FEF5103000-0x000007FEF5104000-memory.dmp

Filesize
4KB

Download
memory/1528-26-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-28-0x0000000000A00000-0x0000000000A0E000-memory.dmp

Filesize
56KB

Download
memory/1528-25-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download
memory/1528-22-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-21-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download
memory/1528-0-0x000007FEF5103000-0x000007FEF5104000-memory.dmp

Filesize
4KB

Download
memory/1528-15-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/1528-7-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-3-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-34-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/1528-32-0x0000000000A10000-0x0000000000A20000-memory.dmp

Filesize
64KB

Download
memory/1528-36-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1528-38-0x0000000002410000-0x000000000241E000-memory.dmp

Filesize
56KB

Download
memory/1528-40-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/1528-42-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/1528-44-0x0000000002580000-0x00000000025DA000-memory.dmp

Filesize
360KB

Download
memory/1528-46-0x0000000002520000-0x000000000252E000-memory.dmp

Filesize
56KB

Download
memory/1528-48-0x0000000002530000-0x0000000002540000-memory.dmp

Filesize
64KB

Download
memory/1528-50-0x0000000002540000-0x000000000254E000-memory.dmp

Filesize
56KB

Download
memory/1528-52-0x00000000025E0000-0x00000000025F8000-memory.dmp

Filesize
96KB

Download
memory/1528-54-0x0000000002550000-0x000000000255C000-memory.dmp

Filesize
48KB

Download
memory/1528-56-0x000000001AC10000-0x000000001AC5E000-memory.dmp

Filesize
312KB

Download
memory/1528-2-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/1528-1-0x00000000003A0000-0x000000000072E000-memory.dmp

Filesize
3.6MB

Download
memory/1528-30-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/2684-76-0x0000000000310000-0x000000000069E000-memory.dmp

Filesize
3.6MB

Download