dcrat | 4a3e0402f692a391300bb5dd374086e2ae642725918fce5a703d686899024559

Analysis

max time kernel
128s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gamingservices.exe
Size

1.8MB
MD5

7e1cbd229ae163375fc55065690e27b4
SHA1

f1cecafde4f843b03f3defffcac7fd6950b582a6
SHA256

4a3e0402f692a391300bb5dd374086e2ae642725918fce5a703d686899024559
SHA512

545c246f2d0159f5c2f7631b891c19166505c525b0a6d66f2338460dfda94679da283aa3e8dffa7fc6fec5752cedbce753f731a7064cff8754970d8968d3c882
SSDEEP

24576:7Sgle/EPZ5XpxBeonQxcYHgC+aviVZZmQ5NnL+MIWRbtHU4aClCbs8HF7Kz9jxG:7AsZWHgReoP7nyWtHPaB37S9jx

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	412	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	412	schtasks.exe	84

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	gamingservices.exe

Executes dropped EXE 1 IoCs

pid	Process
4500	dwm.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\6cb0b6c459d5d3	gamingservices.exe
File created	C:\Program Files\ModifiableWindowsApps\fontdrvhost.exe	gamingservices.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe	gamingservices.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\IdentityCRL\INT\eddb19405b7ce1	gamingservices.exe
File created	C:\Windows\SoftwareDistribution\fontdrvhost.exe	gamingservices.exe
File opened for modification	C:\Windows\SoftwareDistribution\fontdrvhost.exe	gamingservices.exe
File created	C:\Windows\SoftwareDistribution\5b884080fd4f94	gamingservices.exe
File created	C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\System.exe	gamingservices.exe
File created	C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\27d1bcfc3c54e0	gamingservices.exe
File created	C:\Windows\IdentityCRL\INT\backgroundTaskHost.exe	gamingservices.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	gamingservices.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2988	schtasks.exe
4960	schtasks.exe
5028	schtasks.exe
1920	schtasks.exe
1344	schtasks.exe
4400	schtasks.exe
3776	schtasks.exe
4440	schtasks.exe
1728	schtasks.exe
2596	schtasks.exe
2092	schtasks.exe
2276	schtasks.exe
4148	schtasks.exe
3956	schtasks.exe
4336	schtasks.exe
1216	schtasks.exe
4488	schtasks.exe
4728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
2000	gamingservices.exe
4500	dwm.exe
4500	dwm.exe
4500	dwm.exe
4500	dwm.exe
4500	dwm.exe
4500	dwm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	gamingservices.exe
Token: SeDebugPrivilege	4500	dwm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1568	2000	gamingservices.exe	103
PID 2000 wrote to memory of 1568	2000	gamingservices.exe	103
PID 1568 wrote to memory of 3200	1568	cmd.exe	105
PID 1568 wrote to memory of 3200	1568	cmd.exe	105
PID 1568 wrote to memory of 2016	1568	cmd.exe	106
PID 1568 wrote to memory of 2016	1568	cmd.exe	106
PID 1568 wrote to memory of 4500	1568	cmd.exe	113
PID 1568 wrote to memory of 4500	1568	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\gamingservices.exe
"C:\Users\Admin\AppData\Local\Temp\gamingservices.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B4iFVyw2zu.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3200
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe
    "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Windows\IdentityCRL\INT\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\IdentityCRL\INT\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Videos\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\SoftwareDistribution\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "gamingservicesg" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\gamingservices.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "gamingservices" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\gamingservices.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "gamingservicesg" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\gamingservices.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B4iFVyw2zu.bat

Filesize
247B

MD5
2c4f22d0bfa167ce49cee6a2be889d33

SHA1
2849740ee768f559ed3f0a3f1ec3ba3ee891afc4

SHA256
276d1e3e5a8563e5b97ca3166b9c13d93abb3a88f925a4f6d62a17dd56a399cd

SHA512
f431b1e948e8ee3b431def5eae99dd9463ba0b041541f46faced17555bc57f7297cac48fa943feb6f08978d41af13277d4d28ac2e01bdc70ce672080e055f360

Download Submit
C:\Windows\IdentityCRL\INT\backgroundTaskHost.exe

Filesize
1.8MB

MD5
7e1cbd229ae163375fc55065690e27b4

SHA1
f1cecafde4f843b03f3defffcac7fd6950b582a6

SHA256
4a3e0402f692a391300bb5dd374086e2ae642725918fce5a703d686899024559

SHA512
545c246f2d0159f5c2f7631b891c19166505c525b0a6d66f2338460dfda94679da283aa3e8dffa7fc6fec5752cedbce753f731a7064cff8754970d8968d3c882

Download Submit
memory/2000-4-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-14-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-0-0x00007FFCFBDB3000-0x00007FFCFBDB5000-memory.dmp

Filesize
8KB

Download
memory/2000-6-0x00000000032B0000-0x00000000032BE000-memory.dmp

Filesize
56KB

Download
memory/2000-7-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-9-0x000000001BED0000-0x000000001BEEC000-memory.dmp

Filesize
112KB

Download
memory/2000-10-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-11-0x000000001C150000-0x000000001C1A0000-memory.dmp

Filesize
320KB

Download
memory/2000-13-0x000000001BEF0000-0x000000001BF08000-memory.dmp

Filesize
96KB

Download
memory/2000-3-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-2-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-26-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-27-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-28-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-29-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-35-0x00007FFCFBDB0000-0x00007FFCFC871000-memory.dmp

Filesize
10.8MB

Download
memory/2000-1-0x0000000000FC0000-0x0000000001192000-memory.dmp

Filesize
1.8MB

Download