Overview

overview

10

Static

static

10

Serversvc.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    101s
  • max time network
    141s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    27-01-2025 18:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Serversvc.exe

  • Size

    827KB

  • MD5

    2b1b671bc3ef38079bfc62e0383258e8

  • SHA1

    1231c2d534a55d0e0923953e3d238a2052d6fad7

  • SHA256

    50ba49f457fa7dad0a39dbf75d14570d5308b33b1c4141e37223dda5c731f4b9

  • SHA512

    0552db872a39c27e069a6526db6046368887fc2fc42534ab63fb30ed235388cf831b52bec5234b2fb2bec50f774fe17d31a27323b702f03029233d6a1b9d5f23

  • SSDEEP

    12288:YlMOe0Zu4AanEAlKOP6dE1qAmpBfcjYbg4EEgIGSXx9GI:Ye0Zu4AarrP2OCm4g41Zf

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Serversvc.exe
    "C:\Users\Admin\AppData\Local\Temp\Serversvc.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:60
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dOXXCyim1u.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1676
        • C:\Users\Admin\AppData\Local\lsass.exe
          "C:/Users/Admin/AppData/Local/\lsass.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:472
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:/Users/Admin/AppData/Local/\lsass.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3296
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:100
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:/Users/Admin/AppData/Local/\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1536

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\dOXXCyim1u.bat
      Filesize

      204B

      MD5

      cc1228708d166b053e8823aa570f98bc

      SHA1

      c33350c03a0379a886c63d2bcc1fe8db6ab85f2a

      SHA256

      a76c639f888a39c187b5cf596b3d822ef28070ae49c09e4236dd811273f653da

      SHA512

      a361942bd57305c81ca463d628804c7811068a5140c4e8f8d8c52920140e43bf3fddfc8f75c0db334dc4fdf4c63a9076bf92c08513979527abae4a78d4f1447d

      Download Submit

    • C:\Users\Admin\AppData\Local\lsass.exe
      Filesize

      827KB

      MD5

      2b1b671bc3ef38079bfc62e0383258e8

      SHA1

      1231c2d534a55d0e0923953e3d238a2052d6fad7

      SHA256

      50ba49f457fa7dad0a39dbf75d14570d5308b33b1c4141e37223dda5c731f4b9

      SHA512

      0552db872a39c27e069a6526db6046368887fc2fc42534ab63fb30ed235388cf831b52bec5234b2fb2bec50f774fe17d31a27323b702f03029233d6a1b9d5f23

      Download Submit

    • memory/60-0-0x00007FFC3DC33000-0x00007FFC3DC35000-memory.dmp

      Filesize

      8KB

      Download

    • memory/60-1-0x0000000000D30000-0x0000000000E06000-memory.dmp

      Filesize

      856KB

      Download

    • memory/60-3-0x00007FFC3DC30000-0x00007FFC3E6F2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/60-13-0x00007FFC3DC30000-0x00007FFC3E6F2000-memory.dmp

      Filesize

      10.8MB

      Download