dcrat | 17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50

General

Target

17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50.exe
Size

1.1MB
MD5

d9bebe465eb9703f2a1adb5937fc68be
SHA1

ae22dcdb8c5982639bb28fb4dd8848821711aed1
SHA256

17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50
SHA512

22d4e6e3f9877366c9d5d0ccc2fab9335955331646f38a32ef03e1e93c5a91d0a4b829c5159f87cd4a777eddd4b50671e9e26b09d08df0758a95779c8312a6cd
SSDEEP

24576:U2G/nvxW3Ww0tXe0Zu4AarrP2OCm4g41Zf6:UbA30Xe0Z9uYz41o

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/\\taskhost.exe\""	Serversvc.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	3028	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	3028	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	3028	schtasks.exe	35

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00060000000191ad-11.dat	dcrat
behavioral1/memory/2704-13-0x0000000000900000-0x00000000009D6000-memory.dmp	dcrat
behavioral1/memory/2604-23-0x0000000000A70000-0x0000000000B46000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
2704	Serversvc.exe
2604	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2456	cmd.exe
2456	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:/Users/Admin/AppData/Local/\\taskhost.exe\""	Serversvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:/Users/Admin/AppData/Local/\\taskhost.exe\""	Serversvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2192	schtasks.exe
2624	schtasks.exe
2736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	Serversvc.exe
2604	taskhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	Serversvc.exe
Token: SeDebugPrivilege	2604	taskhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2536	2096	17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50.exe	30
PID 2096 wrote to memory of 2536	2096	17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50.exe	30
PID 2096 wrote to memory of 2536	2096	17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50.exe	30
PID 2096 wrote to memory of 2536	2096	17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50.exe	30
PID 2536 wrote to memory of 2456	2536	WScript.exe	32
PID 2536 wrote to memory of 2456	2536	WScript.exe	32
PID 2536 wrote to memory of 2456	2536	WScript.exe	32
PID 2536 wrote to memory of 2456	2536	WScript.exe	32
PID 2456 wrote to memory of 2704	2456	cmd.exe	34
PID 2456 wrote to memory of 2704	2456	cmd.exe	34
PID 2456 wrote to memory of 2704	2456	cmd.exe	34
PID 2456 wrote to memory of 2704	2456	cmd.exe	34
PID 2704 wrote to memory of 2604	2704	Serversvc.exe	39
PID 2704 wrote to memory of 2604	2704	Serversvc.exe	39
PID 2704 wrote to memory of 2604	2704	Serversvc.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50.exe
"C:\Users\Admin\AppData\Local\Temp\17d352f187fbc5bfce4f52bc3f2cfd945e287446d11403e6115948080b1a9f50.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\bridgeComponentCrt\nKJB6Zs08weWG.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\bridgeComponentCrt\AbOXMghu6Hp1TCPLq6iDSJn8zEWjUF.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\bridgeComponentCrt\Serversvc.exe
      "C:\bridgeComponentCrt\Serversvc.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Users\Admin\AppData\Local\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\taskhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:/Users/Admin/AppData/Local/\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:/Users/Admin/AppData/Local/\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\bridgeComponentCrt\AbOXMghu6Hp1TCPLq6iDSJn8zEWjUF.bat

Filesize
37B

MD5
fba137b0206d26e4236cf54f07b2e1d6

SHA1
223fb8506f5c69c81d7e29d2fdff97ece2340216

SHA256
1a097cd2bfcd3fb225ef85d466e63e8bb6941795b7791c6e81d28b2f85d859ae

SHA512
5da8199091468b527e7f8898b857a396f08ef0fd9dd11b2e01945228ea43aad8276519a3bb3f2c259a3d0bb5a1670f659aa6652d3b5cbd4c3631574c315a1635

Download Submit
C:\bridgeComponentCrt\nKJB6Zs08weWG.vbe

Filesize
225B

MD5
d707b3ccfb11e63e10abb2c3ec47411e

SHA1
6302bb98d841def5b1e7a9096449111f106a829b

SHA256
4620c6c35769d741fdc7e3105ac2a283467817d822d9ad360149301bad0f6418

SHA512
5d7566accd25af3e895a746cadad2a37df6bc8f8622305d3d688a21a520f137d94a78fe5f89d039aca2295ea2d00ce37cc81f5cac75ecda616c7b99bfae29484

Download Submit
\bridgeComponentCrt\Serversvc.exe

Filesize
827KB

MD5
2b1b671bc3ef38079bfc62e0383258e8

SHA1
1231c2d534a55d0e0923953e3d238a2052d6fad7

SHA256
50ba49f457fa7dad0a39dbf75d14570d5308b33b1c4141e37223dda5c731f4b9

SHA512
0552db872a39c27e069a6526db6046368887fc2fc42534ab63fb30ed235388cf831b52bec5234b2fb2bec50f774fe17d31a27323b702f03029233d6a1b9d5f23

Download Submit
memory/2604-23-0x0000000000A70000-0x0000000000B46000-memory.dmp

Filesize
856KB

Download
memory/2704-13-0x0000000000900000-0x00000000009D6000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads