dcrat | f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4E9DDBFBEB41BD97825E0F79426307CB.exe
Size

2.1MB
MD5

4e9ddbfbeb41bd97825e0f79426307cb
SHA1

f7c1150945e4d9ac8f86b0e0c5ee5f2441e1983b
SHA256

f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987
SHA512

b73e5343ef1c7f662e8c134db76a639228eb2ef7e3d3c78648a1b329986243c5d1e43c57541e4f5392dfc44bf967942f093b511cb3dff7390f352168635e2dca
SSDEEP

24576:2TbBv5rUyXVIHaYHemPiKIUdWp9NZAXY000Ub/TdvsXhhbtRtAC+IEZ9rSyzPXcE:IBJwJRIfpxAXalU7tPA3IEHHPo25fNJ

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	MsAgentDriverruntime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	4E9DDBFBEB41BD97825E0F79426307CB.exe

Executes dropped EXE 2 IoCs

pid	Process
2324	MsAgentDriverruntime.exe
3004	dllhost.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe	MsAgentDriverruntime.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\5940a34987c991	MsAgentDriverruntime.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\csrss.exe	MsAgentDriverruntime.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\886983d96e3d3e	MsAgentDriverruntime.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\dllhost.exe	MsAgentDriverruntime.exe
File created	C:\Windows\Fonts\5940a34987c991	MsAgentDriverruntime.exe
File created	C:\Windows\Fonts\dllhost.exe	MsAgentDriverruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E9DDBFBEB41BD97825E0F79426307CB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	4E9DDBFBEB41BD97825E0F79426307CB.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	MsAgentDriverruntime.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe
2324	MsAgentDriverruntime.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	MsAgentDriverruntime.exe
Token: SeDebugPrivilege	3004	dllhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1616	2932	4E9DDBFBEB41BD97825E0F79426307CB.exe	83
PID 2932 wrote to memory of 1616	2932	4E9DDBFBEB41BD97825E0F79426307CB.exe	83
PID 2932 wrote to memory of 1616	2932	4E9DDBFBEB41BD97825E0F79426307CB.exe	83
PID 1616 wrote to memory of 5060	1616	WScript.exe	93
PID 1616 wrote to memory of 5060	1616	WScript.exe	93
PID 1616 wrote to memory of 5060	1616	WScript.exe	93
PID 5060 wrote to memory of 2324	5060	cmd.exe	95
PID 5060 wrote to memory of 2324	5060	cmd.exe	95
PID 2324 wrote to memory of 4048	2324	MsAgentDriverruntime.exe	97
PID 2324 wrote to memory of 4048	2324	MsAgentDriverruntime.exe	97
PID 4048 wrote to memory of 832	4048	cmd.exe	101
PID 4048 wrote to memory of 832	4048	cmd.exe	101
PID 4048 wrote to memory of 2096	4048	cmd.exe	102
PID 4048 wrote to memory of 2096	4048	cmd.exe	102
PID 4048 wrote to memory of 3004	4048	cmd.exe	104
PID 4048 wrote to memory of 3004	4048	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\4E9DDBFBEB41BD97825E0F79426307CB.exe
"C:\Users\Admin\AppData\Local\Temp\4E9DDBFBEB41BD97825E0F79426307CB.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\winRefruntime\T8Mz9n0cgvFWE.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\winRefruntime\MsAgentDriverruntime.exe
      "C:\winRefruntime/MsAgentDriverruntime.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b4v59DQHkh.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4048
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:832
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2096
      - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b4v59DQHkh.bat

Filesize
256B

MD5
1c2d6f35aaa6093652efc5bece82ad13

SHA1
9bddbc48635272c4db5ec70165bac5e76703d095

SHA256
ef4dab03084e7ff8dd0e3e8777edb2e1c61acbca5cd930fc74314e92acb27380

SHA512
7aee45821f282b34fdff3c11ae0d6e7e29a8945c20aba323c3585ff900b5e3f627babd6af05518293b2721bd431d3a880a2bd4cbd491ae4f418c727b2d62091e

Download Submit
C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe

Filesize
204B

MD5
f71d833e6aeb52188ee610b077d8ccc6

SHA1
d75cb50568151b006529144b7e9176ceb10d20ec

SHA256
fe1e34b8c3b97e4d9d228456cbd70c882751ac3566c4db9ac0c0dd69736a8506

SHA512
6b40363e6805bbd53a700df9606ce9005c739f9d03c229f970f5487ffd292454ebefda13155161516ec847abdfb6f61f8c67ffb281a1e476823dd2bf1127da06

Download Submit
C:\winRefruntime\MsAgentDriverruntime.exe

Filesize
1.8MB

MD5
c3a0c717ed8a025658e5a4c0f53281d9

SHA1
1e7eddfcc83d9b03d69dbaaa64e925792fd6c76d

SHA256
e1b05cf5e4c9736a90867217dd7208573bacb4822e4083c999a8212cb59c83dd

SHA512
c359a40a89d5cf191dd08d81d6077364b6b974e4e83ddaab6ba04df8098aa9742cf73bf5170e5e528cc255c0ceda39905b7a84fa30db2118cc62b855f839a501

Download Submit
C:\winRefruntime\T8Mz9n0cgvFWE.bat

Filesize
95B

MD5
adf2bf7bf445880f81f96361a56948ef

SHA1
59b5b4bc70d488217da1b2c2b5b64d5fc968eb8e

SHA256
ad92ed1e126adffda821e88ec4dbb6dab360d69b94871228a63e2dd0601065e0

SHA512
202865468a0fa699788afeca8b3b1eb5296e98d56958c2edc0ea83191a192ebb7e620029632e7d7671bee749bf3dd8781d4497f461894f10451edc985c41324e

Download Submit
memory/2324-12-0x00007FFD6E843000-0x00007FFD6E845000-memory.dmp

Filesize
8KB

Download
memory/2324-13-0x0000000000FF0000-0x00000000011CA000-memory.dmp

Filesize
1.9MB

Download
memory/2324-15-0x00000000032E0000-0x00000000032EE000-memory.dmp

Filesize
56KB

Download
memory/2324-17-0x0000000003310000-0x000000000332C000-memory.dmp

Filesize
112KB

Download
memory/2324-18-0x000000001BFB0000-0x000000001C000000-memory.dmp

Filesize
320KB

Download
memory/2324-20-0x0000000003330000-0x0000000003348000-memory.dmp

Filesize
96KB

Download
memory/2324-22-0x00000000032F0000-0x00000000032FC000-memory.dmp

Filesize
48KB

Download