dcrat | 715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76

General

Target

715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe
Size

829KB
MD5

4009f012c67a909b3e30c3b179db5c1c
SHA1

55c96f7b89a50031058cb0764885c49967394dfb
SHA256

715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76
SHA512

0c18cef0b27609265de49a761f026376a6811801233b323ed30781f1018a7a1855900c8edb63e417a27cb89b4d5a04671c53ea56bf1ed904ad07825ce8a5eef6
SSDEEP

12288:aGiX93/xLFsYqnIIktZs0CT2DfdGbLQ8JYL/XOaraRP3OZWw:aGit3/xLF6nlktZs0X2g/OaraF3OZWw

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2536	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2536	schtasks.exe	30

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1692-1-0x0000000000AF0000-0x0000000000BC6000-memory.dmp	dcrat
behavioral1/files/0x0009000000016241-15.dat	dcrat
behavioral1/memory/1172-17-0x0000000000F80000-0x0000000001056000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1172	audiodg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\http\audiodg.exe	715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\42af1c969fbb7b	715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2756	schtasks.exe
2660	schtasks.exe
856	schtasks.exe
2776	schtasks.exe
2816	schtasks.exe
2836	schtasks.exe
2188	schtasks.exe
2384	schtasks.exe
1676	schtasks.exe
2888	schtasks.exe
2896	schtasks.exe
2628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe
1172	audiodg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe
Token: SeDebugPrivilege	1172	audiodg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1172	1692	715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe	43
PID 1692 wrote to memory of 1172	1692	715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe	43
PID 1692 wrote to memory of 1172	1692	715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe
"C:\Users\Admin\AppData\Local\Temp\715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files\VideoLAN\VLC\lua\http\audiodg.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\audiodg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\http\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\VideoLAN\VLC\lua\http\audiodg.exe

Filesize
829KB

MD5
4009f012c67a909b3e30c3b179db5c1c

SHA1
55c96f7b89a50031058cb0764885c49967394dfb

SHA256
715f3b9c490abf08c544ba284eccd6fa58aa6ee93dd810ce24000531b4ed3d76

SHA512
0c18cef0b27609265de49a761f026376a6811801233b323ed30781f1018a7a1855900c8edb63e417a27cb89b4d5a04671c53ea56bf1ed904ad07825ce8a5eef6

Download Submit
memory/1172-17-0x0000000000F80000-0x0000000001056000-memory.dmp

Filesize
856KB

Download
memory/1692-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/1692-1-0x0000000000AF0000-0x0000000000BC6000-memory.dmp

Filesize
856KB

Download
memory/1692-2-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/1692-18-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads