dcrat | ecfdb52196e58db344d66e7ec2e65cb589315dd7bed55bc2a0fe6afe86898433

General

Target

JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Size

1.1MB
MD5

d2887b8a1e477a97c84e4b126cb360a3
SHA1

8fb6cdbc31616bd460e703b5bcb77367321c5c8a
SHA256

ecfdb52196e58db344d66e7ec2e65cb589315dd7bed55bc2a0fe6afe86898433
SHA512

0691b082aba27120413d99749edd4da34e39488ec3da3e325c93dd36a64b725e7d1623b62b87f4a1b064ee42c2c60e05f0d6d0f7520e81b8b7753820446a667b
SSDEEP

12288:s4tUwqOjgrbMHiYVNtdE50qoc+vFqa/out/vsQJktVXN/JEqII1ZpvxIBGLEqqn4:zGfgcsVTdE507cQtHpq/KKvxUGLF+4

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1084-1-0x0000000000380000-0x00000000004A4000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b79-11.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe

Executes dropped EXE 1 IoCs

pid	Process
2172	OfficeClickToRun.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\LanguageComponentsInstaller\\fontdrvhost.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\timesync\\dwm.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\All Users\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\S-1-5-21-4089630652-1596403869-279772308-1000\\dllhost.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\PerfLogs\\wininit.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\DeviceSetupStatusProvider\\RuntimeBroker.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\cdp\\RuntimeBroker.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Documents and Settings\\OfficeClickToRun.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\All Users\\WindowsHolographicDevices\\unsecapp.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\Start Menu\\services.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\Microsoft.LocalUserImageProvider\\RuntimeBroker.exe\""	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\DeviceSetupStatusProvider\RuntimeBroker.exe	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
File created	C:\Windows\System32\cdp\RuntimeBroker.exe	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
File created	C:\Windows\System32\LanguageComponentsInstaller\fontdrvhost.exe	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
File created	C:\Windows\System32\timesync\dwm.exe	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
File created	C:\Windows\System32\timesync\6cb0b6c459d5d3455a3da700e713f2e2529862ff	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
File created	C:\Windows\System32\DeviceSetupStatusProvider\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
File created	C:\Windows\System32\cdp\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
File created	C:\Windows\System32\LanguageComponentsInstaller\5b884080fd4f94e2695da25c503f9e33b9605b83	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
File created	C:\Windows\System32\Microsoft.LocalUserImageProvider\RuntimeBroker.exe	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
File created	C:\Windows\System32\Microsoft.LocalUserImageProvider\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4616	schtasks.exe
1984	schtasks.exe
2400	schtasks.exe
4156	schtasks.exe
4988	schtasks.exe
3104	schtasks.exe
3156	schtasks.exe
2936	schtasks.exe
3932	schtasks.exe
2652	schtasks.exe
1932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
2172	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
Token: SeDebugPrivilege	2172	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2172	1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe	94
PID 1084 wrote to memory of 2172	1084	JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d2887b8a1e477a97c84e4b126cb360a3.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Documents and Settings\OfficeClickToRun.exe
  "C:\Documents and Settings\OfficeClickToRun.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\S-1-5-21-4089630652-1596403869-279772308-1000\dllhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\PerfLogs\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\DeviceSetupStatusProvider\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\cdp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Documents and Settings\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\LanguageComponentsInstaller\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\services.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\PerfLogs\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\timesync\dwm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\Microsoft.LocalUserImageProvider\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\OfficeClickToRun.exe

Filesize
1.1MB

MD5
d2887b8a1e477a97c84e4b126cb360a3

SHA1
8fb6cdbc31616bd460e703b5bcb77367321c5c8a

SHA256
ecfdb52196e58db344d66e7ec2e65cb589315dd7bed55bc2a0fe6afe86898433

SHA512
0691b082aba27120413d99749edd4da34e39488ec3da3e325c93dd36a64b725e7d1623b62b87f4a1b064ee42c2c60e05f0d6d0f7520e81b8b7753820446a667b

Download Submit
memory/1084-0-0x00007FFF66363000-0x00007FFF66365000-memory.dmp

Filesize
8KB

Download
memory/1084-1-0x0000000000380000-0x00000000004A4000-memory.dmp

Filesize
1.1MB

Download
memory/1084-4-0x00007FFF66360000-0x00007FFF66E21000-memory.dmp

Filesize
10.8MB

Download
memory/1084-37-0x00007FFF66360000-0x00007FFF66E21000-memory.dmp

Filesize
10.8MB

Download
memory/2172-39-0x00000000028D0000-0x00000000028DC000-memory.dmp

Filesize
48KB

Download
memory/2172-38-0x00000000028C0000-0x00000000028CC000-memory.dmp

Filesize
48KB

Download
memory/2172-43-0x0000000002940000-0x000000000294A000-memory.dmp

Filesize
40KB

Download
memory/2172-42-0x0000000002930000-0x0000000002938000-memory.dmp

Filesize
32KB

Download
memory/2172-41-0x00000000028E0000-0x00000000028EC000-memory.dmp

Filesize
48KB

Download
memory/2172-40-0x0000000002900000-0x000000000290C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads