dcrat | f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987

Analysis

max time kernel
121s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe
Size

2.1MB
MD5

4e9ddbfbeb41bd97825e0f79426307cb
SHA1

f7c1150945e4d9ac8f86b0e0c5ee5f2441e1983b
SHA256

f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987
SHA512

b73e5343ef1c7f662e8c134db76a639228eb2ef7e3d3c78648a1b329986243c5d1e43c57541e4f5392dfc44bf967942f093b511cb3dff7390f352168635e2dca
SSDEEP

24576:2TbBv5rUyXVIHaYHemPiKIUdWp9NZAXY000Ub/TdvsXhhbtRtAC+IEZ9rSyzPXcE:IBJwJRIfpxAXalU7tPA3IEHHPo25fNJ

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Executes dropped EXE 2 IoCs

pid	Process
2900	MsAgentDriverruntime.exe
2932	MsAgentDriverruntime.exe

Loads dropped DLL 2 IoCs

pid	Process
2764	cmd.exe
2764	cmd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\spoolsv.exe	MsAgentDriverruntime.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\f3b6ecef712a24	MsAgentDriverruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe
2900	MsAgentDriverruntime.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	MsAgentDriverruntime.exe
Token: SeDebugPrivilege	2932	MsAgentDriverruntime.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2812	2248	f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe	31
PID 2248 wrote to memory of 2812	2248	f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe	31
PID 2248 wrote to memory of 2812	2248	f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe	31
PID 2248 wrote to memory of 2812	2248	f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe	31
PID 2812 wrote to memory of 2764	2812	WScript.exe	32
PID 2812 wrote to memory of 2764	2812	WScript.exe	32
PID 2812 wrote to memory of 2764	2812	WScript.exe	32
PID 2812 wrote to memory of 2764	2812	WScript.exe	32
PID 2764 wrote to memory of 2900	2764	cmd.exe	34
PID 2764 wrote to memory of 2900	2764	cmd.exe	34
PID 2764 wrote to memory of 2900	2764	cmd.exe	34
PID 2764 wrote to memory of 2900	2764	cmd.exe	34
PID 2900 wrote to memory of 2364	2900	MsAgentDriverruntime.exe	35
PID 2900 wrote to memory of 2364	2900	MsAgentDriverruntime.exe	35
PID 2900 wrote to memory of 2364	2900	MsAgentDriverruntime.exe	35
PID 2364 wrote to memory of 1832	2364	cmd.exe	37
PID 2364 wrote to memory of 1832	2364	cmd.exe	37
PID 2364 wrote to memory of 1832	2364	cmd.exe	37
PID 2364 wrote to memory of 1724	2364	cmd.exe	38
PID 2364 wrote to memory of 1724	2364	cmd.exe	38
PID 2364 wrote to memory of 1724	2364	cmd.exe	38
PID 2364 wrote to memory of 2932	2364	cmd.exe	39
PID 2364 wrote to memory of 2932	2364	cmd.exe	39
PID 2364 wrote to memory of 2932	2364	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe
"C:\Users\Admin\AppData\Local\Temp\f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\winRefruntime\T8Mz9n0cgvFWE.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\winRefruntime\MsAgentDriverruntime.exe
      "C:\winRefruntime/MsAgentDriverruntime.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Vz5BlZc098.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1832
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1724
      - C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\MsAgentDriverruntime.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\MsAgentDriverruntime.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Vz5BlZc098.bat

Filesize
249B

MD5
267dafd317c74936ed867fd52defe5a8

SHA1
bbc6b7965f276cf700dfaafe945f5ec6b304c058

SHA256
5eba49803632793f748b3f0bb5cbc6f7b24b33597cc20b924cba3597d8c45643

SHA512
fe406e8f189d201e1341e647104bab6d79a338ceaa6505fd316a8624ecaf33cb98e6a7172632991633948669752d0333cb10ceaf1defabcb5c8e07d03ab3f361

Download Submit
C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe

Filesize
204B

MD5
f71d833e6aeb52188ee610b077d8ccc6

SHA1
d75cb50568151b006529144b7e9176ceb10d20ec

SHA256
fe1e34b8c3b97e4d9d228456cbd70c882751ac3566c4db9ac0c0dd69736a8506

SHA512
6b40363e6805bbd53a700df9606ce9005c739f9d03c229f970f5487ffd292454ebefda13155161516ec847abdfb6f61f8c67ffb281a1e476823dd2bf1127da06

Download Submit
C:\winRefruntime\T8Mz9n0cgvFWE.bat

Filesize
95B

MD5
adf2bf7bf445880f81f96361a56948ef

SHA1
59b5b4bc70d488217da1b2c2b5b64d5fc968eb8e

SHA256
ad92ed1e126adffda821e88ec4dbb6dab360d69b94871228a63e2dd0601065e0

SHA512
202865468a0fa699788afeca8b3b1eb5296e98d56958c2edc0ea83191a192ebb7e620029632e7d7671bee749bf3dd8781d4497f461894f10451edc985c41324e

Download Submit
\winRefruntime\MsAgentDriverruntime.exe

Filesize
1.8MB

MD5
c3a0c717ed8a025658e5a4c0f53281d9

SHA1
1e7eddfcc83d9b03d69dbaaa64e925792fd6c76d

SHA256
e1b05cf5e4c9736a90867217dd7208573bacb4822e4083c999a8212cb59c83dd

SHA512
c359a40a89d5cf191dd08d81d6077364b6b974e4e83ddaab6ba04df8098aa9742cf73bf5170e5e528cc255c0ceda39905b7a84fa30db2118cc62b855f839a501

Download Submit
memory/2900-13-0x00000000008E0000-0x0000000000ABA000-memory.dmp

Filesize
1.9MB

Download
memory/2900-15-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/2900-17-0x00000000005D0000-0x00000000005EC000-memory.dmp

Filesize
112KB

Download
memory/2900-19-0x00000000005F0000-0x0000000000608000-memory.dmp

Filesize
96KB

Download
memory/2900-21-0x00000000005B0000-0x00000000005BC000-memory.dmp

Filesize
48KB

Download
memory/2932-40-0x0000000000BE0000-0x0000000000DBA000-memory.dmp

Filesize
1.9MB

Download