dcrat | 75ec6658e2172199d78c87db3de2f85c1f49d229703e12d1725a0913ca4fe213

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Size

10.1MB
MD5

8afb3959eaf496cd8a73a3d91e25e22c
SHA1

44681a9d143cfd48ad3c7fe37e5b4c8f8378b22b
SHA256

75ec6658e2172199d78c87db3de2f85c1f49d229703e12d1725a0913ca4fe213
SHA512

0ec5a1fe87bd1cb5cdd5f686156d88313a57eba46b73f435dc98de5d07bf87d8cf86eb8640b2bdd0314c43bff27bf079708897c0ca5477bbbb2f2cc9405de0d1
SSDEEP

24576:W+O4GptFtiU9SsYm1oO9teGnlcZ/uIO0EdZX0usIW6fgtixy4s+8BIbT19h8OChG:x5o9Y+Iu0u+YoAgO9kK4XyWDAyH6e

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\lsass.exe\", \"C:\\PerfLogs\\Admin\\wininit.exe\", \"C:\\Windows\\setuperr\\explorer.exe\", \"C:\\Windows\\System32\\d3d8thk\\csrss.exe\", \"C:\\Windows\\System32\\winrm\\taskhost.exe\", \"C:\\Windows\\System32\\vga\\spoolsv.exe\", \"C:\\Windows\\System32\\sdcpl\\lsm.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\lsass.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\lsass.exe\", \"C:\\PerfLogs\\Admin\\wininit.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\lsass.exe\", \"C:\\PerfLogs\\Admin\\wininit.exe\", \"C:\\Windows\\setuperr\\explorer.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\lsass.exe\", \"C:\\PerfLogs\\Admin\\wininit.exe\", \"C:\\Windows\\setuperr\\explorer.exe\", \"C:\\Windows\\System32\\d3d8thk\\csrss.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\lsass.exe\", \"C:\\PerfLogs\\Admin\\wininit.exe\", \"C:\\Windows\\setuperr\\explorer.exe\", \"C:\\Windows\\System32\\d3d8thk\\csrss.exe\", \"C:\\Windows\\System32\\winrm\\taskhost.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\lsass.exe\", \"C:\\PerfLogs\\Admin\\wininit.exe\", \"C:\\Windows\\setuperr\\explorer.exe\", \"C:\\Windows\\System32\\d3d8thk\\csrss.exe\", \"C:\\Windows\\System32\\winrm\\taskhost.exe\", \"C:\\Windows\\System32\\vga\\spoolsv.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe

Executes dropped EXE 1 IoCs

pid	Process
2076	taskhost.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\sdcpl\\lsm.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\PerfLogs\\Admin\\wininit.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\setuperr\\explorer.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\d3d8thk\\csrss.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\winrm\\taskhost.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\winrm\\taskhost.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\vga\\spoolsv.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\vga\\spoolsv.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\sdcpl\\lsm.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\lsass.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\PerfLogs\\Admin\\wininit.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\d3d8thk\\csrss.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\lsass.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\setuperr\\explorer.exe\""	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\winrm\taskhost.exe	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File opened for modification	C:\Windows\System32\winrm\taskhost.exe	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Windows\System32\vga\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Windows\System32\sdcpl\lsm.exe	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Windows\System32\d3d8thk\csrss.exe	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Windows\System32\d3d8thk\886983d96e3d3e31032c679b2d4ea91b6c05afef	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Windows\System32\sdcpl\101b941d020240259ca4912829b53995ad543df6	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Windows\System32\winrm\b75386f1303e64d8139363b71e44ac16341adf4e	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Windows\System32\vga\spoolsv.exe	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\lsass.exe	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\it-IT\lsass.exe	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Program Files\Windows Media Player\Icons\csrss.exe	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\setuperr\explorer.exe	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
File created	C:\Windows\setuperr\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2960	schtasks.exe
2184	schtasks.exe
3020	schtasks.exe
1876	schtasks.exe
2600	schtasks.exe
2760	schtasks.exe
2924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2228	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
2228	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
2228	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
2660	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe
2076	taskhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Token: SeDebugPrivilege	2660	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
Token: SeDebugPrivilege	2076	taskhost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2660	2228	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe	35
PID 2228 wrote to memory of 2660	2228	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe	35
PID 2228 wrote to memory of 2660	2228	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe	35
PID 2660 wrote to memory of 576	2660	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe	39
PID 2660 wrote to memory of 576	2660	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe	39
PID 2660 wrote to memory of 576	2660	JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe	39
PID 576 wrote to memory of 2884	576	cmd.exe	41
PID 576 wrote to memory of 2884	576	cmd.exe	41
PID 576 wrote to memory of 2884	576	cmd.exe	41
PID 576 wrote to memory of 2076	576	cmd.exe	42
PID 576 wrote to memory of 2076	576	cmd.exe	42
PID 576 wrote to memory of 2076	576	cmd.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8afb3959eaf496cd8a73a3d91e25e22c.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OX4rqzIdHm.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2884
  - - C:\Windows\System32\winrm\taskhost.exe
      "C:\Windows\System32\winrm\taskhost.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\PerfLogs\Admin\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\setuperr\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\d3d8thk\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\winrm\taskhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\vga\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\sdcpl\lsm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OX4rqzIdHm.bat

Filesize
202B

MD5
452837e3b0c711d3e50337ebf7f8dae4

SHA1
212e71a89c7381bc0b28dd391afa9ee3e0a0b50f

SHA256
2274761711a42af058821ca86177937ace5eed6cb3a87c6e7895d8d43de2ffee

SHA512
a595da741b3c14ab5a7c868d0e7f3f7417573168f6eb72edb2049e5868f2f77b09f451b22940cf1c577827e9461225414ac95175ce4e6b23c10abea34a82bc89

Download Submit
C:\Windows\System32\winrm\taskhost.exe

Filesize
10.1MB

MD5
8afb3959eaf496cd8a73a3d91e25e22c

SHA1
44681a9d143cfd48ad3c7fe37e5b4c8f8378b22b

SHA256
75ec6658e2172199d78c87db3de2f85c1f49d229703e12d1725a0913ca4fe213

SHA512
0ec5a1fe87bd1cb5cdd5f686156d88313a57eba46b73f435dc98de5d07bf87d8cf86eb8640b2bdd0314c43bff27bf079708897c0ca5477bbbb2f2cc9405de0d1

Download Submit
memory/2076-25-0x0000000000010000-0x0000000000A3A000-memory.dmp

Filesize
10.2MB

Download
memory/2076-26-0x0000000000E80000-0x0000000000E8C000-memory.dmp

Filesize
48KB

Download
memory/2076-27-0x0000000000E90000-0x0000000000E9C000-memory.dmp

Filesize
48KB

Download
memory/2076-28-0x0000000000ED0000-0x0000000000EDC000-memory.dmp

Filesize
48KB

Download
memory/2076-29-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Filesize
32KB

Download
memory/2076-30-0x0000000000EE0000-0x0000000000EEA000-memory.dmp

Filesize
40KB

Download
memory/2228-11-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2228-2-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2228-1-0x0000000000050000-0x0000000000A7A000-memory.dmp

Filesize
10.2MB

Download
memory/2228-0-0x000007FEF5303000-0x000007FEF5304000-memory.dmp

Filesize
4KB

Download