dcrat | 69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7

General

Target

69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe
Size

828KB
MD5

c6b30f794dcf67851d13e3335ef57088
SHA1

e97b575fc270d97d1e2df38291fd44dc70ff95ab
SHA256

69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7
SHA512

28dc37c57408fa9e6e3a14a99d602e6c0f937e259f21eefd016424d03d40066e6b518c9b0bcbae8039c1691ce43ba8803c568ad69df163938e4ff2235c55188b
SSDEEP

12288:K5jHYVjmobNqsKDsSvjbHQVtVZJizDxRxhDsGALvbI6bnY6a2Xuk:1b4sKDZUZJuR/ALvbLnY8Xuk

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	3456	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	3456	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	3456	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	3456	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	3456	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3456	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	3456	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	3456	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	3456	schtasks.exe	83

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2288-1-0x0000000000B90000-0x0000000000C66000-memory.dmp	dcrat
behavioral2/files/0x0007000000023c8b-10.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe

Executes dropped EXE 1 IoCs

pid	Process
3860	OfficeClickToRun.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\69ddcba757bf72	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\79830cf113bf46	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe
File created	C:\Program Files\Mozilla Firefox\smss.exe	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\smss.exe	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4928	schtasks.exe
1504	schtasks.exe
1092	schtasks.exe
2600	schtasks.exe
2668	schtasks.exe
2040	schtasks.exe
2576	schtasks.exe
5068	schtasks.exe
3748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2288	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe
3860	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe
Token: SeDebugPrivilege	3860	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3860	2288	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe	93
PID 2288 wrote to memory of 3860	2288	69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe
"C:\Users\Admin\AppData\Local\Temp\69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Recovery\WindowsRE\OfficeClickToRun.exe
  "C:\Recovery\WindowsRE\OfficeClickToRun.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d76" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d76" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\OfficeClickToRun.exe

Filesize
828KB

MD5
c6b30f794dcf67851d13e3335ef57088

SHA1
e97b575fc270d97d1e2df38291fd44dc70ff95ab

SHA256
69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7

SHA512
28dc37c57408fa9e6e3a14a99d602e6c0f937e259f21eefd016424d03d40066e6b518c9b0bcbae8039c1691ce43ba8803c568ad69df163938e4ff2235c55188b

Download Submit
memory/2288-0-0x00007FF9E2CE3000-0x00007FF9E2CE5000-memory.dmp

Filesize
8KB

Download
memory/2288-1-0x0000000000B90000-0x0000000000C66000-memory.dmp

Filesize
856KB

Download
memory/2288-2-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

Filesize
10.8MB

Download
memory/2288-20-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads