dcrat | 7a89d7167264d77656b8cac1cef82a3e16f3dd51d679b178833a953a5cb11235

General

Target

JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Size

2.0MB
MD5

de80b75daf9e3549c0d61166fbe0f147
SHA1

445c7a4e543c319dff09d12b77b9aa33bfccc5ff
SHA256

7a89d7167264d77656b8cac1cef82a3e16f3dd51d679b178833a953a5cb11235
SHA512

83f8b92ef215e0398ee38963bcedce1590384b0f1a8f17cb09749c887c78ede374890965a01cb475ac0794a4eafb5ac7c0b48e347a6df7eda58b2fe1cbe657d1
SSDEEP

49152:cwj3o71JZAB3jBn8cjcdPH/+yDMu3JgHzCueUTG:cBLZABTF8Ic94u3YveX

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\dllhost.exe\", \"C:\\Windows\\System32\\net\\winlogon.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\dllhost.exe\", \"C:\\Windows\\System32\\net\\winlogon.exe\", \"C:\\Windows\\System32\\wbem\\mswmdm\\WmiPrvSE.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\dllhost.exe\", \"C:\\Windows\\System32\\net\\winlogon.exe\", \"C:\\Windows\\System32\\wbem\\mswmdm\\WmiPrvSE.exe\", \"C:\\Windows\\addins\\Idle.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\dllhost.exe\", \"C:\\Windows\\System32\\net\\winlogon.exe\", \"C:\\Windows\\System32\\wbem\\mswmdm\\WmiPrvSE.exe\", \"C:\\Windows\\addins\\Idle.exe\", \"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\taskhost.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\dllhost.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2680	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2680	schtasks.exe	30

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2380-1-0x0000000001020000-0x000000000122E000-memory.dmp	dcrat
behavioral1/files/0x0005000000019382-11.dat	dcrat
behavioral1/memory/2172-19-0x0000000000B40000-0x0000000000D4E000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2172	winlogon.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\taskhost.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\taskhost.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\net\\winlogon.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\dllhost.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\net\\winlogon.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\mswmdm\\WmiPrvSE.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\mswmdm\\WmiPrvSE.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\addins\\Idle.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\addins\\Idle.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\\dllhost.exe\""	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\net\winlogon.exe	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
File created	C:\Windows\System32\net\cc11b995f2a76da408ea6a601e682e64743153ad	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
File created	C:\Windows\System32\wbem\mswmdm\WmiPrvSE.exe	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
File created	C:\Windows\System32\wbem\mswmdm\24dbde2999530ef5fd907494bc374d663924116c	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\addins\Idle.exe	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
File created	C:\Windows\addins\6ccacd8608530fba3a93e87ae2225c7032aa18c1	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2568	schtasks.exe
2660	schtasks.exe
2560	schtasks.exe
780	schtasks.exe
2580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2380	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
2380	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
2380	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
2172	winlogon.exe
2172	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
Token: SeDebugPrivilege	2172	winlogon.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2172	2380	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe	36
PID 2380 wrote to memory of 2172	2380	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe	36
PID 2380 wrote to memory of 2172	2380	JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de80b75daf9e3549c0d61166fbe0f147.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\net\winlogon.exe
  "C:\Windows\System32\net\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\net\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\mswmdm\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\addins\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe

Filesize
2.0MB

MD5
de80b75daf9e3549c0d61166fbe0f147

SHA1
445c7a4e543c319dff09d12b77b9aa33bfccc5ff

SHA256
7a89d7167264d77656b8cac1cef82a3e16f3dd51d679b178833a953a5cb11235

SHA512
83f8b92ef215e0398ee38963bcedce1590384b0f1a8f17cb09749c887c78ede374890965a01cb475ac0794a4eafb5ac7c0b48e347a6df7eda58b2fe1cbe657d1

Download Submit
memory/2172-27-0x0000000000A60000-0x0000000000A68000-memory.dmp

Filesize
32KB

Download
memory/2172-24-0x00000000006D0000-0x0000000000726000-memory.dmp

Filesize
344KB

Download
memory/2172-29-0x0000000000A80000-0x0000000000A88000-memory.dmp

Filesize
32KB

Download
memory/2172-30-0x0000000000A90000-0x0000000000A98000-memory.dmp

Filesize
32KB

Download
memory/2172-19-0x0000000000B40000-0x0000000000D4E000-memory.dmp

Filesize
2.1MB

Download
memory/2172-21-0x0000000000240000-0x000000000024C000-memory.dmp

Filesize
48KB

Download
memory/2172-28-0x0000000000A70000-0x0000000000A78000-memory.dmp

Filesize
32KB

Download
memory/2172-22-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/2172-23-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/2172-25-0x0000000000430000-0x0000000000438000-memory.dmp

Filesize
32KB

Download
memory/2172-26-0x0000000000A50000-0x0000000000A5C000-memory.dmp

Filesize
48KB

Download
memory/2380-0-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Filesize
4KB

Download
memory/2380-2-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2380-20-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2380-1-0x0000000001020000-0x000000000122E000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads