dcrat | 3fe87dde7e2f707307d03115bf5aad1ad08ee11d8f9b4ce28579a54be834fbd6

General

Target

JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91.exe
Size

1.5MB
MD5

dfc81712a62d2f2852ea631060a9ee91
SHA1

c6ed37c61d3b143e66b4abb53cccc4db1b0c61d1
SHA256

3fe87dde7e2f707307d03115bf5aad1ad08ee11d8f9b4ce28579a54be834fbd6
SHA512

1f3460a22cd25ed57056a4fae119ccf5ba983c4151b092759c84f30adeeb199b22af0a1caf5709f924b2b8190756aeca9757576ba95ed5bec705c5e3d393b832
SSDEEP

24576:T2G/nvxW3W7/okMlI4tH7Da3x1VStiA7iw63VboDAJDyL+qq+aWTIN+4H:TbA3m/oosbwswq63IEUI

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	4968	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b97-10.dat	dcrat
behavioral2/memory/452-13-0x0000000000620000-0x000000000070C000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	driverintoperfCommonsessiondll.exe

Executes dropped EXE 2 IoCs

pid	Process
452	driverintoperfCommonsessiondll.exe
4984	SppExtComObj.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Documents and Settings\\OfficeClickToRun.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\eappgnui\\SppExtComObj.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Windows Multimedia Platform\\taskhostw.exe\""	driverintoperfCommonsessiondll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Default\\Videos\\TextInputHost.exe\""	driverintoperfCommonsessiondll.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\eappgnui\SppExtComObj.exe	driverintoperfCommonsessiondll.exe
File created	C:\Windows\System32\eappgnui\e1ef82546f0b02b7e974f28047f3788b1128cce1	driverintoperfCommonsessiondll.exe
File created	C:\Windows\System32\eappgnui\SppExtComObj.exe	driverintoperfCommonsessiondll.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\taskhostw.exe	driverintoperfCommonsessiondll.exe
File created	C:\Program Files\Windows Multimedia Platform\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	driverintoperfCommonsessiondll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	driverintoperfCommonsessiondll.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2516	schtasks.exe
4504	schtasks.exe
1756	schtasks.exe
1040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
452	driverintoperfCommonsessiondll.exe
4984	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	driverintoperfCommonsessiondll.exe
Token: SeDebugPrivilege	4984	SppExtComObj.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4280	5088	JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91.exe	84
PID 5088 wrote to memory of 4280	5088	JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91.exe	84
PID 5088 wrote to memory of 4280	5088	JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91.exe	84
PID 4280 wrote to memory of 2768	4280	WScript.exe	86
PID 4280 wrote to memory of 2768	4280	WScript.exe	86
PID 4280 wrote to memory of 2768	4280	WScript.exe	86
PID 2768 wrote to memory of 452	2768	cmd.exe	88
PID 2768 wrote to memory of 452	2768	cmd.exe	88
PID 452 wrote to memory of 3508	452	driverintoperfCommonsessiondll.exe	95
PID 452 wrote to memory of 3508	452	driverintoperfCommonsessiondll.exe	95
PID 3508 wrote to memory of 3524	3508	cmd.exe	99
PID 3508 wrote to memory of 3524	3508	cmd.exe	99
PID 3508 wrote to memory of 4984	3508	cmd.exe	106
PID 3508 wrote to memory of 4984	3508	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\driverintoperfCommon\cnLEOZ0Cs77BjiYBoldKr4XhBkP7.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\driverintoperfCommon\CAvx95pfV2AM7XiAa.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\driverintoperfCommon\driverintoperfCommonsessiondll.exe
      "C:\driverintoperfCommon\driverintoperfCommonsessiondll.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:452
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhqbgYKrMk.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3508
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3524
      - C:\Windows\System32\eappgnui\SppExtComObj.exe
        
        "C:\Windows\System32\eappgnui\SppExtComObj.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\eappgnui\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Videos\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Documents and Settings\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jhqbgYKrMk.bat

Filesize
209B

MD5
7ed7a43079ccbadbe6235b39a5ba1d16

SHA1
4f5b8c41cdd76335dfd950922d0607fa51c61cbc

SHA256
cb6a6d14945fd62e37aad22c36bf2f642d3880fe4e877f3a9cbac996f49154df

SHA512
ed52228a72737d48b6a1a18faa4fcec987a9b20e199bf3f1477b0c40e1ca37ba5994ea0edae1db97a9a956d9ff8e62ce31470225348eb4f0ecd921d1725278fc

Download Submit
C:\driverintoperfCommon\CAvx95pfV2AM7XiAa.bat

Filesize
60B

MD5
7714e2b53919911e980444b45460395e

SHA1
21cddd2196d4e75bbb2cc7707b94934932680d07

SHA256
6e0f83f0badfed55ce960d3f3b49b742c3f2bf50e36beefd48fdbb2d0b71bc8c

SHA512
2611942f953a7c4deaf4a80863279a309befa69171f2e657a671afc52b9540dbada2b147280ac2af05d71e78802ba56b0cd82bfe8799fcd53805ffa0b828ae03

Download Submit
C:\driverintoperfCommon\cnLEOZ0Cs77BjiYBoldKr4XhBkP7.vbe

Filesize
214B

MD5
bbfc29b101d00fa56d63c01944c2f151

SHA1
432bdc5301e5876aaa53bb2cf5379dc3b1504def

SHA256
4f54c1b2f29bb436b25e7ecd25077ec1e17768ea30319fd7f7bf0e94898ad912

SHA512
341b25874b56d61edc53074043f5a714582751ae60170a57200ea7c02375f9e327149ca0dd980f3afea6a5da79cfeca5aa2b9cf8d4cc08b2f59d9ec195a1e906

Download Submit
C:\driverintoperfCommon\driverintoperfCommonsessiondll.exe

Filesize
912KB

MD5
7902d7438cd06a2393e97a07fbf53b08

SHA1
6cd4f8d9510d87d2f112cd6be3e92dba29456319

SHA256
9cb41290c48b270282afbcc08569844197c642382bb79d621568fa3ac0ca1439

SHA512
81d167bf915501a286285f6e1f08419c9576713549f3cef6e7dd7954874e9a43e5b1d18e7546fd696afeffcb9f8f43069dd5f11302f12259d83c652b6c5a3cd0

Download Submit
memory/452-12-0x00007FFEEB113000-0x00007FFEEB115000-memory.dmp

Filesize
8KB

Download
memory/452-13-0x0000000000620000-0x000000000070C000-memory.dmp

Filesize
944KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads