dcrat | fe48d8776f5c31ba36162463e3a5a89378ef4a177c6d9cf74750ff469b5de3d3

General

Target

containerServerperf.exe
Size

828KB
MD5

ddce5f6cd47da319bbd8141d3a0fa618
SHA1

4b3bafd730ebc70dcc1441fca2c21b81fab9ea03
SHA256

fe48d8776f5c31ba36162463e3a5a89378ef4a177c6d9cf74750ff469b5de3d3
SHA512

05e82ea24d54336cd33bb297967c8eb773389ded37401041739152ff5ad212fbc2d2a6660b27277517071b89c02ab8fb3859d9bc03add1f91ea86eb516a18d59
SSDEEP

12288:nc79Njwwi1Zn7YnnDh47SqeJazwiXbAxQhcMBmXq3dq:nWTwXPnIh3qeJaEKl1tq

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5300	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5312	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	6072	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	6072	schtasks.exe	77

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral3/memory/2500-1-0x00000000004E0000-0x00000000005B6000-memory.dmp	dcrat
behavioral3/files/0x001900000002ab6f-11.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
4332	wininit.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\SppExtComObj.exe	containerServerperf.exe
File created	C:\Program Files\Microsoft Office\root\Client\e1ef82546f0b02	containerServerperf.exe
File created	C:\Program Files\WindowsApps\wininit.exe	containerServerperf.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe	containerServerperf.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\886983d96e3d3e	containerServerperf.exe
File created	C:\Program Files\Windows Media Player\fr-FR\winlogon.exe	containerServerperf.exe
File created	C:\Program Files\Windows Media Player\fr-FR\cc11b995f2a76d	containerServerperf.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\56085415360792	containerServerperf.exe
File created	C:\Windows\ja-JP\wininit.exe	containerServerperf.exe
File created	C:\Windows\ja-JP\56085415360792	containerServerperf.exe
File created	C:\Windows\CbsTemp\csrss.exe	containerServerperf.exe
File created	C:\Windows\CbsTemp\886983d96e3d3e	containerServerperf.exe
File created	C:\Windows\Downloaded Program Files\wininit.exe	containerServerperf.exe
File opened for modification	C:\Windows\Downloaded Program Files\wininit.exe	containerServerperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	containerServerperf.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1616	schtasks.exe
2488	schtasks.exe
5092	schtasks.exe
2496	schtasks.exe
1728	schtasks.exe
3828	schtasks.exe
5300	schtasks.exe
3116	schtasks.exe
4596	schtasks.exe
404	schtasks.exe
1980	schtasks.exe
5312	schtasks.exe
3576	schtasks.exe
3996	schtasks.exe
4072	schtasks.exe
2928	schtasks.exe
4476	schtasks.exe
4772	schtasks.exe
1372	schtasks.exe
4056	schtasks.exe
2324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2500	containerServerperf.exe
2500	containerServerperf.exe
2500	containerServerperf.exe
2500	containerServerperf.exe
2500	containerServerperf.exe
4332	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	containerServerperf.exe
Token: SeDebugPrivilege	4332	wininit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3752	2500	containerServerperf.exe	99
PID 2500 wrote to memory of 3752	2500	containerServerperf.exe	99
PID 3752 wrote to memory of 3696	3752	cmd.exe	101
PID 3752 wrote to memory of 3696	3752	cmd.exe	101
PID 3752 wrote to memory of 4332	3752	cmd.exe	102
PID 3752 wrote to memory of 4332	3752	cmd.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\containerServerperf.exe
"C:\Users\Admin\AppData\Local\Temp\containerServerperf.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2eAu1p5Kf.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3696
- - C:\Windows\ja-JP\wininit.exe
    "C:\Windows\ja-JP\wininit.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\Downloaded Program Files\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\Downloaded Program Files\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\ja-JP\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ja-JP\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\ja-JP\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\CbsTemp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\CbsTemp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\fr-FR\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\root\Client\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Client\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\root\Client\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe

Filesize
828KB

MD5
ddce5f6cd47da319bbd8141d3a0fa618

SHA1
4b3bafd730ebc70dcc1441fca2c21b81fab9ea03

SHA256
fe48d8776f5c31ba36162463e3a5a89378ef4a177c6d9cf74750ff469b5de3d3

SHA512
05e82ea24d54336cd33bb297967c8eb773389ded37401041739152ff5ad212fbc2d2a6660b27277517071b89c02ab8fb3859d9bc03add1f91ea86eb516a18d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\D2eAu1p5Kf.bat

Filesize
193B

MD5
776d0970cbb0cd1334971c877aaee58c

SHA1
87ceb6b1dd3cf04c6668145aca6a071a8505f9a8

SHA256
5502fd17da6086d2b8c387c2afec40602c9d6d0e98fab20748d2e5b13d498810

SHA512
65f0cfb980c32fdac3e760998f8e28e954362547d2b7ff91db7b72eafb6507ce83f5ebc6be360d0ad3843f3c5be56c087b55f785a071452b30832448713b3258

Download Submit
memory/2500-0-0x00007FFAE0EE3000-0x00007FFAE0EE5000-memory.dmp

Filesize
8KB

Download
memory/2500-1-0x00000000004E0000-0x00000000005B6000-memory.dmp

Filesize
856KB

Download
memory/2500-2-0x00007FFAE0EE0000-0x00007FFAE19A2000-memory.dmp

Filesize
10.8MB

Download
memory/2500-23-0x00007FFAE0EE0000-0x00007FFAE19A2000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads