dcrat | 64ac9d88e8e64873dbe503bb52fecbd0481689a0895bd6d89b6d0c3335c0cdfb

General

Target

JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
Size

910KB
MD5

c19cd7830905473e79a23fb6983bfd39
SHA1

de5d55b5242e543bc33fe14414a04692b7dd72b4
SHA256

64ac9d88e8e64873dbe503bb52fecbd0481689a0895bd6d89b6d0c3335c0cdfb
SHA512

9d72cb75aede54b332d70988688b50d8611cd506d92ebab6b6fa93fd53d3afefbdbeb15e82f562c1640a9dd3a69da0a715d3d68fb1b58da16b3cb463eacc0bff
SSDEEP

24576:6yY5mNErQCK/rNtnqsIxcEGU4Dp8dH4+4:Q5maMCK/b24DpKb

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	1520	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	1520	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	1520	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	1520	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	1520	schtasks.exe	30

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2312-1-0x0000000000C50000-0x0000000000D3A000-memory.dmp	dcrat
behavioral1/files/0x00050000000186ed-11.dat	dcrat
behavioral1/memory/2776-19-0x0000000001370000-0x000000000145A000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2776	sppsvc.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\mfc120enu\\sppsvc.exe\""	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT\\OSPPSVC.exe\""	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\bitsprx5\\csrss.exe\""	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\wininit.exe\""	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\spopk\\smss.exe\""	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\bitsprx5\886983d96e3d3e31032c679b2d4ea91b6c05afef	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
File created	C:\Windows\System32\spopk\smss.exe	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
File created	C:\Windows\System32\spopk\69ddcba757bf72f7d36c464c71f42baab150b2b9	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
File created	C:\Windows\System32\mfc120enu\sppsvc.exe	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
File opened for modification	C:\Windows\System32\mfc120enu\sppsvc.exe	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
File created	C:\Windows\System32\mfc120enu\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
File created	C:\Windows\System32\bitsprx5\csrss.exe	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT\OSPPSVC.exe	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT\1610b97d3ab4a74cd8ae104b51bea7bfcc5b9c6f	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2548	schtasks.exe
1988	schtasks.exe
2016	schtasks.exe
2472	schtasks.exe
2892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2312	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
2776	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
Token: SeDebugPrivilege	2776	sppsvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2776	2312	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe	36
PID 2312 wrote to memory of 2776	2312	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe	36
PID 2312 wrote to memory of 2776	2312	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe	36
PID 2312 wrote to memory of 2776	2312	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe	36
PID 2312 wrote to memory of 2776	2312	JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c19cd7830905473e79a23fb6983bfd39.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\System32\mfc120enu\sppsvc.exe
  "C:\Windows\System32\mfc120enu\sppsvc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\mfc120enu\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\bitsprx5\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\spopk\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\spopk\smss.exe

Filesize
910KB

MD5
c19cd7830905473e79a23fb6983bfd39

SHA1
de5d55b5242e543bc33fe14414a04692b7dd72b4

SHA256
64ac9d88e8e64873dbe503bb52fecbd0481689a0895bd6d89b6d0c3335c0cdfb

SHA512
9d72cb75aede54b332d70988688b50d8611cd506d92ebab6b6fa93fd53d3afefbdbeb15e82f562c1640a9dd3a69da0a715d3d68fb1b58da16b3cb463eacc0bff

Download Submit
memory/2312-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/2312-1-0x0000000000C50000-0x0000000000D3A000-memory.dmp

Filesize
936KB

Download
memory/2312-2-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2312-20-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2776-19-0x0000000001370000-0x000000000145A000-memory.dmp

Filesize
936KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads