dcrat | 17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50

General

Target

mega porno.exe
Size

1.1MB
MD5

d9bebe465eb9703f2a1adb5937fc68be
SHA1

ae22dcdb8c5982639bb28fb4dd8848821711aed1
SHA256

17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50
SHA512

22d4e6e3f9877366c9d5d0ccc2fab9335955331646f38a32ef03e1e93c5a91d0a4b829c5159f87cd4a777eddd4b50671e9e26b09d08df0758a95779c8312a6cd
SSDEEP

24576:U2G/nvxW3Ww0tXe0Zu4AarrP2OCm4g41Zf6:UbA30Xe0Z9uYz41o

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/\\dllhost.exe\""	Serversvc.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	2772	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2772	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	2772	schtasks.exe	82

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x001b00000002aaad-9.dat	dcrat
behavioral2/memory/2816-13-0x0000000000220000-0x00000000002F6000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
2816	Serversvc.exe
224	dllhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:/Users/Admin/AppData/Local/\\dllhost.exe\""	Serversvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:/Users/Admin/AppData/Local/\\dllhost.exe\""	Serversvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mega porno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	mega porno.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	Serversvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4884	schtasks.exe
3356	schtasks.exe
2576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2816	Serversvc.exe
224	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	Serversvc.exe
Token: SeDebugPrivilege	224	dllhost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2768	3032	mega porno.exe	78
PID 3032 wrote to memory of 2768	3032	mega porno.exe	78
PID 3032 wrote to memory of 2768	3032	mega porno.exe	78
PID 2768 wrote to memory of 1676	2768	WScript.exe	79
PID 2768 wrote to memory of 1676	2768	WScript.exe	79
PID 2768 wrote to memory of 1676	2768	WScript.exe	79
PID 1676 wrote to memory of 2816	1676	cmd.exe	81
PID 1676 wrote to memory of 2816	1676	cmd.exe	81
PID 2816 wrote to memory of 2488	2816	Serversvc.exe	86
PID 2816 wrote to memory of 2488	2816	Serversvc.exe	86
PID 2488 wrote to memory of 5068	2488	cmd.exe	88
PID 2488 wrote to memory of 5068	2488	cmd.exe	88
PID 2488 wrote to memory of 224	2488	cmd.exe	89
PID 2488 wrote to memory of 224	2488	cmd.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mega porno.exe
"C:\Users\Admin\AppData\Local\Temp\mega porno.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\bridgeComponentCrt\nKJB6Zs08weWG.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\bridgeComponentCrt\AbOXMghu6Hp1TCPLq6iDSJn8zEWjUF.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\bridgeComponentCrt\Serversvc.exe
      "C:\bridgeComponentCrt\Serversvc.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Z5BVRdGGP.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2488
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\dllhost.exe
        
        "C:/Users/Admin/AppData/Local/\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0Z5BVRdGGP.bat

Filesize
206B

MD5
756eefbd30264d6af37c585f8e17ddf2

SHA1
6beb41c953b07874f17bcb1dbb51972e41b107da

SHA256
90b3ea4429794f6824d7b397a05a169f3b5761a5469f5d20e2c374f8755b3683

SHA512
9c40a8cb0dc52df4d020eeaf88a327615373fd75e9c9a828210883d781817d8d26170e5bd50a5bc6225010a8afc45cb7270ed84c7bbb7e959bb0000c6df58f6b

Download Submit
C:\bridgeComponentCrt\AbOXMghu6Hp1TCPLq6iDSJn8zEWjUF.bat

Filesize
37B

MD5
fba137b0206d26e4236cf54f07b2e1d6

SHA1
223fb8506f5c69c81d7e29d2fdff97ece2340216

SHA256
1a097cd2bfcd3fb225ef85d466e63e8bb6941795b7791c6e81d28b2f85d859ae

SHA512
5da8199091468b527e7f8898b857a396f08ef0fd9dd11b2e01945228ea43aad8276519a3bb3f2c259a3d0bb5a1670f659aa6652d3b5cbd4c3631574c315a1635

Download Submit
C:\bridgeComponentCrt\Serversvc.exe

Filesize
827KB

MD5
2b1b671bc3ef38079bfc62e0383258e8

SHA1
1231c2d534a55d0e0923953e3d238a2052d6fad7

SHA256
50ba49f457fa7dad0a39dbf75d14570d5308b33b1c4141e37223dda5c731f4b9

SHA512
0552db872a39c27e069a6526db6046368887fc2fc42534ab63fb30ed235388cf831b52bec5234b2fb2bec50f774fe17d31a27323b702f03029233d6a1b9d5f23

Download Submit
C:\bridgeComponentCrt\nKJB6Zs08weWG.vbe

Filesize
225B

MD5
d707b3ccfb11e63e10abb2c3ec47411e

SHA1
6302bb98d841def5b1e7a9096449111f106a829b

SHA256
4620c6c35769d741fdc7e3105ac2a283467817d822d9ad360149301bad0f6418

SHA512
5d7566accd25af3e895a746cadad2a37df6bc8f8622305d3d688a21a520f137d94a78fe5f89d039aca2295ea2d00ce37cc81f5cac75ecda616c7b99bfae29484

Download Submit
memory/2816-12-0x00007FFF5E8F3000-0x00007FFF5E8F5000-memory.dmp

Filesize
8KB

Download
memory/2816-13-0x0000000000220000-0x00000000002F6000-memory.dmp

Filesize
856KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads