dcrat | f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4E9DDBFBEB41BD97825E0F79426307CB.exe
Size

2.1MB
MD5

4e9ddbfbeb41bd97825e0f79426307cb
SHA1

f7c1150945e4d9ac8f86b0e0c5ee5f2441e1983b
SHA256

f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987
SHA512

b73e5343ef1c7f662e8c134db76a639228eb2ef7e3d3c78648a1b329986243c5d1e43c57541e4f5392dfc44bf967942f093b511cb3dff7390f352168635e2dca
SSDEEP

24576:2TbBv5rUyXVIHaYHemPiKIUdWp9NZAXY000Ub/TdvsXhhbtRtAC+IEZ9rSyzPXcE:IBJwJRIfpxAXalU7tPA3IEHHPo25fNJ

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	4E9DDBFBEB41BD97825E0F79426307CB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	MsAgentDriverruntime.exe

Executes dropped EXE 2 IoCs

pid	Process
4160	MsAgentDriverruntime.exe
3928	taskhostw.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\9e8d7a4ca61bd9	MsAgentDriverruntime.exe
File created	C:\Program Files\Windows Mail\smss.exe	MsAgentDriverruntime.exe
File created	C:\Program Files\Windows Mail\69ddcba757bf72	MsAgentDriverruntime.exe
File created	C:\Program Files\dotnet\RuntimeBroker.exe	MsAgentDriverruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E9DDBFBEB41BD97825E0F79426307CB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	MsAgentDriverruntime.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	4E9DDBFBEB41BD97825E0F79426307CB.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe
4160	MsAgentDriverruntime.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	MsAgentDriverruntime.exe
Token: SeDebugPrivilege	3928	taskhostw.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 64	324	4E9DDBFBEB41BD97825E0F79426307CB.exe	82
PID 324 wrote to memory of 64	324	4E9DDBFBEB41BD97825E0F79426307CB.exe	82
PID 324 wrote to memory of 64	324	4E9DDBFBEB41BD97825E0F79426307CB.exe	82
PID 64 wrote to memory of 4588	64	WScript.exe	83
PID 64 wrote to memory of 4588	64	WScript.exe	83
PID 64 wrote to memory of 4588	64	WScript.exe	83
PID 4588 wrote to memory of 4160	4588	cmd.exe	85
PID 4588 wrote to memory of 4160	4588	cmd.exe	85
PID 4160 wrote to memory of 4824	4160	MsAgentDriverruntime.exe	86
PID 4160 wrote to memory of 4824	4160	MsAgentDriverruntime.exe	86
PID 4824 wrote to memory of 3940	4824	cmd.exe	88
PID 4824 wrote to memory of 3940	4824	cmd.exe	88
PID 4824 wrote to memory of 4900	4824	cmd.exe	89
PID 4824 wrote to memory of 4900	4824	cmd.exe	89
PID 4824 wrote to memory of 3928	4824	cmd.exe	94
PID 4824 wrote to memory of 3928	4824	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\4E9DDBFBEB41BD97825E0F79426307CB.exe
"C:\Users\Admin\AppData\Local\Temp\4E9DDBFBEB41BD97825E0F79426307CB.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\winRefruntime\T8Mz9n0cgvFWE.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\winRefruntime\MsAgentDriverruntime.exe
      "C:\winRefruntime/MsAgentDriverruntime.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q77fnXVw5g.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4824
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3940
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4900
      - C:\Users\Admin\Application Data\taskhostw.exe
        
        "C:\Users\Admin\Application Data\taskhostw.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\q77fnXVw5g.bat

Filesize
221B

MD5
bee00952b96866593c965b70ee3f8389

SHA1
5e856121756bbd10de50a64253db7de11d9dfe47

SHA256
7e70a64313a65d907e2828e86925b6742aa32eeaf2280d94993e86292ffe29e8

SHA512
78115936e1b92a363b13850292698a1a94f9e80b35752995ab99afad69720130e527816206bb951a24f847706a9603a36eaf2db2a5feb312c8afa604c5dddf2c

Download Submit
C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe

Filesize
204B

MD5
f71d833e6aeb52188ee610b077d8ccc6

SHA1
d75cb50568151b006529144b7e9176ceb10d20ec

SHA256
fe1e34b8c3b97e4d9d228456cbd70c882751ac3566c4db9ac0c0dd69736a8506

SHA512
6b40363e6805bbd53a700df9606ce9005c739f9d03c229f970f5487ffd292454ebefda13155161516ec847abdfb6f61f8c67ffb281a1e476823dd2bf1127da06

Download Submit
C:\winRefruntime\MsAgentDriverruntime.exe

Filesize
1.8MB

MD5
c3a0c717ed8a025658e5a4c0f53281d9

SHA1
1e7eddfcc83d9b03d69dbaaa64e925792fd6c76d

SHA256
e1b05cf5e4c9736a90867217dd7208573bacb4822e4083c999a8212cb59c83dd

SHA512
c359a40a89d5cf191dd08d81d6077364b6b974e4e83ddaab6ba04df8098aa9742cf73bf5170e5e528cc255c0ceda39905b7a84fa30db2118cc62b855f839a501

Download Submit
C:\winRefruntime\T8Mz9n0cgvFWE.bat

Filesize
95B

MD5
adf2bf7bf445880f81f96361a56948ef

SHA1
59b5b4bc70d488217da1b2c2b5b64d5fc968eb8e

SHA256
ad92ed1e126adffda821e88ec4dbb6dab360d69b94871228a63e2dd0601065e0

SHA512
202865468a0fa699788afeca8b3b1eb5296e98d56958c2edc0ea83191a192ebb7e620029632e7d7671bee749bf3dd8781d4497f461894f10451edc985c41324e

Download Submit
memory/4160-12-0x00007FF868113000-0x00007FF868115000-memory.dmp

Filesize
8KB

Download
memory/4160-13-0x0000000000CC0000-0x0000000000E9A000-memory.dmp

Filesize
1.9MB

Download
memory/4160-15-0x0000000002F70000-0x0000000002F7E000-memory.dmp

Filesize
56KB

Download
memory/4160-17-0x000000001B9C0000-0x000000001B9DC000-memory.dmp

Filesize
112KB

Download
memory/4160-18-0x000000001BA50000-0x000000001BAA0000-memory.dmp

Filesize
320KB

Download
memory/4160-20-0x000000001B9E0000-0x000000001B9F8000-memory.dmp

Filesize
96KB

Download
memory/4160-22-0x000000001B9A0000-0x000000001B9AC000-memory.dmp

Filesize
48KB

Download