dcrat | c91143795474ec192096650cddcacd5d4e0d46b384e8a56dab7ca029ac2a7d43

Analysis

max time kernel
28s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2025, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Winver.exe
Size 1.8MB
Sample250101-psc68axmbm
SHA256 c91143795474ec192096650cddcacd5d4e0d46b384e8a56dab7ca029ac2a7d43
MD5 d4f263a3feebfe196d5eceb651c9ffb7
SHA1 dde163a9747f48004ed85777ced25062b16c62d7
SHA512 f933264ab7fe364946619938a6997566f583f69a8d75698da4ad77833ce9e4514153fc5d54477fd9e19ae12e5b7fe19bdbc2a2c17a51d53f3c632a48635aa967
SSDEEP 24576:dPzRN7hPeAb+kB559xtG4qPj4wYoyaOufGW26fydwYGfIlDl/DX/vo2y:doAb+WxttdgyaOuJ2Myccb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	3240	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	3240	schtasks.exe	82

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Winver.exe

Executes dropped EXE 1 IoCs

pid	Process
3116	fontdrvhost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\27d1bcfc3c54e0	Winver.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\System.exe	Winver.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\servicing\InboxFodMetadataCache\metadata\csrss.exe	Winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2152	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	Winver.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2152	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2364	schtasks.exe
1148	schtasks.exe
1780	schtasks.exe
216	schtasks.exe
2024	schtasks.exe
2460	schtasks.exe
4144	schtasks.exe
2388	schtasks.exe
3076	schtasks.exe
3620	schtasks.exe
2012	schtasks.exe
1680	schtasks.exe
3416	schtasks.exe
3704	schtasks.exe
1904	schtasks.exe
4644	schtasks.exe
2588	schtasks.exe
3928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe
2772	Winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	Winver.exe
Token: SeDebugPrivilege	3116	fontdrvhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 3324	2772	Winver.exe	101
PID 2772 wrote to memory of 3324	2772	Winver.exe	101
PID 3324 wrote to memory of 3828	3324	cmd.exe	103
PID 3324 wrote to memory of 3828	3324	cmd.exe	103
PID 3324 wrote to memory of 2152	3324	cmd.exe	104
PID 3324 wrote to memory of 2152	3324	cmd.exe	104
PID 3324 wrote to memory of 3116	3324	cmd.exe	109
PID 3324 wrote to memory of 3116	3324	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Winver.exe
"C:\Users\Admin\AppData\Local\Temp\Winver.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eVx41bBAa8.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3828
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2152
- - C:\Users\Admin\Documents\fontdrvhost.exe
    "C:\Users\Admin\Documents\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Documents\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Documents\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Documents\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinverW" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\Winver.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Winver" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\Winver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinverW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\Winver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Recovery\WindowsRE\dwm.exe
Size 1.8MB
SHA256 c91143795474ec192096650cddcacd5d4e0d46b384e8a56dab7ca029ac2a7d43
MD5 d4f263a3feebfe196d5eceb651c9ffb7
SHA1 dde163a9747f48004ed85777ced25062b16c62d7
SHA512 f933264ab7fe364946619938a6997566f583f69a8d75698da4ad77833ce9e4514153fc5d54477fd9e19ae12e5b7fe19bdbc2a2c17a51d53f3c632a48635aa967
SSDEEP 24576:dPzRN7hPeAb+kB559xtG4qPj4wYoyaOufGW26fydwYGfIlDl/DX/vo2y:doAb+WxttdgyaOuJ2Myccb
MD5 SHA1 SHA512 SSDEEP

Submit Download

eVx41bBAa8.bat

Path C:\Users\Admin\AppData\Local\Temp\eVx41bBAa8.bat
Size 168B
SHA256 0fa8cd30c40b57bee26b3c0f22b091baabd725738a1bfa39e5d35c873e3fb5e2
MD5 bea1527e74d8f7d6830be77e084a8247
SHA1 9447e9ac0c764578384ae07ea66b54c2b2e7ea91
SHA512 4d02e9d3b5856c43d1c29c4813ea41c78cd5f158d10bb88ad6f236b063f6f5249995327838be94e598c82a8bf2eebcd67722cf445a973f4b87ffdd528d544687
MD5 SHA1 SHA512

Submit Download

memory/2772-8-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download

memory/2772-11-0x000000001C140000-0x000000001C190000-memory.dmp

Download

memory/2772-4-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download

memory/2772-6-0x000000001BD50000-0x000000001BD5E000-memory.dmp

Download

memory/2772-7-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download

memory/2772-10-0x000000001BD80000-0x000000001BD9C000-memory.dmp

Download

memory/2772-0-0x00007FFCCA253000-0x00007FFCCA255000-memory.dmp

Download

memory/2772-3-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download

memory/2772-13-0x000000001BDA0000-0x000000001BDB8000-memory.dmp

Download

memory/2772-15-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download

memory/2772-18-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download

memory/2772-2-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download

memory/2772-27-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download

memory/2772-31-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download

memory/2772-1-0x0000000000F90000-0x0000000001162000-memory.dmp

Download

memory/2772-35-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Download