dcrat | f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-01-2025 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4E9DDBFBEB41BD97825E0F79426307CB.exe
Size

2.1MB
MD5

4e9ddbfbeb41bd97825e0f79426307cb
SHA1

f7c1150945e4d9ac8f86b0e0c5ee5f2441e1983b
SHA256

f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987
SHA512

b73e5343ef1c7f662e8c134db76a639228eb2ef7e3d3c78648a1b329986243c5d1e43c57541e4f5392dfc44bf967942f093b511cb3dff7390f352168635e2dca
SSDEEP

24576:2TbBv5rUyXVIHaYHemPiKIUdWp9NZAXY000Ub/TdvsXhhbtRtAC+IEZ9rSyzPXcE:IBJwJRIfpxAXalU7tPA3IEHHPo25fNJ

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Executes dropped EXE 2 IoCs

pid	Process
2696	MsAgentDriverruntime.exe
2324	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2236	cmd.exe
2236	cmd.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\MsAgentDriverruntime.exe	MsAgentDriverruntime.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\c15a51ac2517ec	MsAgentDriverruntime.exe
File created	C:\Program Files\DVD Maker\fr-FR\Idle.exe	MsAgentDriverruntime.exe
File created	C:\Program Files\DVD Maker\fr-FR\6ccacd8608530f	MsAgentDriverruntime.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe	MsAgentDriverruntime.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe	MsAgentDriverruntime.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\cc11b995f2a76d	MsAgentDriverruntime.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\69ddcba757bf72	MsAgentDriverruntime.exe
File created	C:\Windows\AppPatch\fr-FR\WmiPrvSE.exe	MsAgentDriverruntime.exe
File created	C:\Windows\AppPatch\fr-FR\24dbde2999530e	MsAgentDriverruntime.exe
File created	C:\Windows\twain_32\smss.exe	MsAgentDriverruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E9DDBFBEB41BD97825E0F79426307CB.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2792	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2792	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2696	MsAgentDriverruntime.exe
2324	winlogon.exe
2324	winlogon.exe
2324	winlogon.exe
2324	winlogon.exe
2324	winlogon.exe
2324	winlogon.exe
2324	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	MsAgentDriverruntime.exe
Token: SeDebugPrivilege	2324	winlogon.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 560	320	4E9DDBFBEB41BD97825E0F79426307CB.exe	31
PID 320 wrote to memory of 560	320	4E9DDBFBEB41BD97825E0F79426307CB.exe	31
PID 320 wrote to memory of 560	320	4E9DDBFBEB41BD97825E0F79426307CB.exe	31
PID 320 wrote to memory of 560	320	4E9DDBFBEB41BD97825E0F79426307CB.exe	31
PID 560 wrote to memory of 2236	560	WScript.exe	32
PID 560 wrote to memory of 2236	560	WScript.exe	32
PID 560 wrote to memory of 2236	560	WScript.exe	32
PID 560 wrote to memory of 2236	560	WScript.exe	32
PID 2236 wrote to memory of 2696	2236	cmd.exe	34
PID 2236 wrote to memory of 2696	2236	cmd.exe	34
PID 2236 wrote to memory of 2696	2236	cmd.exe	34
PID 2236 wrote to memory of 2696	2236	cmd.exe	34
PID 2696 wrote to memory of 2752	2696	MsAgentDriverruntime.exe	35
PID 2696 wrote to memory of 2752	2696	MsAgentDriverruntime.exe	35
PID 2696 wrote to memory of 2752	2696	MsAgentDriverruntime.exe	35
PID 2752 wrote to memory of 2668	2752	cmd.exe	37
PID 2752 wrote to memory of 2668	2752	cmd.exe	37
PID 2752 wrote to memory of 2668	2752	cmd.exe	37
PID 2752 wrote to memory of 2792	2752	cmd.exe	38
PID 2752 wrote to memory of 2792	2752	cmd.exe	38
PID 2752 wrote to memory of 2792	2752	cmd.exe	38
PID 2752 wrote to memory of 2324	2752	cmd.exe	39
PID 2752 wrote to memory of 2324	2752	cmd.exe	39
PID 2752 wrote to memory of 2324	2752	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\4E9DDBFBEB41BD97825E0F79426307CB.exe
"C:\Users\Admin\AppData\Local\Temp\4E9DDBFBEB41BD97825E0F79426307CB.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\winRefruntime\T8Mz9n0cgvFWE.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\winRefruntime\MsAgentDriverruntime.exe
      "C:\winRefruntime/MsAgentDriverruntime.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\C5CTOMuPAM.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2752
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2668
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2792
      - C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C5CTOMuPAM.bat

Filesize
184B

MD5
36d4ed79523e2078ec94c436c95b1d40

SHA1
3ef57e6ab8c93056d4b5429b8e67344b19dfab54

SHA256
866a905dc89bbc89c40571d1ed9285b681913d3060d7d9bbb085c9edfc44f2b1

SHA512
dad6fc4559f39d3f3837b55c43e87040ad5edf352a81fd09af0702df5d4faca16fd69a538f5d9ac4fb323a0f62178f1e35b65c01e7711091853373b2c65a825d

Download Submit
C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe

Filesize
204B

MD5
f71d833e6aeb52188ee610b077d8ccc6

SHA1
d75cb50568151b006529144b7e9176ceb10d20ec

SHA256
fe1e34b8c3b97e4d9d228456cbd70c882751ac3566c4db9ac0c0dd69736a8506

SHA512
6b40363e6805bbd53a700df9606ce9005c739f9d03c229f970f5487ffd292454ebefda13155161516ec847abdfb6f61f8c67ffb281a1e476823dd2bf1127da06

Download Submit
C:\winRefruntime\MsAgentDriverruntime.exe

Filesize
1.8MB

MD5
c3a0c717ed8a025658e5a4c0f53281d9

SHA1
1e7eddfcc83d9b03d69dbaaa64e925792fd6c76d

SHA256
e1b05cf5e4c9736a90867217dd7208573bacb4822e4083c999a8212cb59c83dd

SHA512
c359a40a89d5cf191dd08d81d6077364b6b974e4e83ddaab6ba04df8098aa9742cf73bf5170e5e528cc255c0ceda39905b7a84fa30db2118cc62b855f839a501

Download Submit
C:\winRefruntime\T8Mz9n0cgvFWE.bat

Filesize
95B

MD5
adf2bf7bf445880f81f96361a56948ef

SHA1
59b5b4bc70d488217da1b2c2b5b64d5fc968eb8e

SHA256
ad92ed1e126adffda821e88ec4dbb6dab360d69b94871228a63e2dd0601065e0

SHA512
202865468a0fa699788afeca8b3b1eb5296e98d56958c2edc0ea83191a192ebb7e620029632e7d7671bee749bf3dd8781d4497f461894f10451edc985c41324e

Download Submit
memory/2324-40-0x0000000000FF0000-0x00000000011CA000-memory.dmp

Filesize
1.9MB

Download
memory/2696-13-0x0000000001350000-0x000000000152A000-memory.dmp

Filesize
1.9MB

Download
memory/2696-15-0x0000000000390000-0x000000000039E000-memory.dmp

Filesize
56KB

Download
memory/2696-17-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/2696-19-0x00000000003E0000-0x00000000003F8000-memory.dmp

Filesize
96KB

Download
memory/2696-21-0x00000000003A0000-0x00000000003AC000-memory.dmp

Filesize
48KB

Download