dcrat | e21cfe74517aaaad37fd5b4825fa4eb97edc6c8daeb386e0cf562b5901f7fdeb

Analysis

max time kernel
11s
max time network
3s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28-01-2025 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

2.1MB
MD5

261edf92e8d85c7a9f7151080ea80467
SHA1

be7cba5291a89ccaed22bfb092a7651d34a36def
SHA256

e21cfe74517aaaad37fd5b4825fa4eb97edc6c8daeb386e0cf562b5901f7fdeb
SHA512

bec64fce5dc2a93edf16963236c975409ca4f40c8809e6a16661578d99ff0fd09178c0d7c293211f6da2419342e71e9532f17d6e455a5ef573326c4fa7fb7c8c
SSDEEP

24576:2TbBv5rUyXVcPzRN7hPeAb+kB559xtG4qPj4wYoyaOufGW26fydwYGfIlDl/DX/p:IBJcoAb+WxttdgyaOuJ2Myccbx

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	2100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	2100	schtasks.exe	88

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3933156042-2316999077-2687276773-1000\Control Panel\International\Geo\Nation	1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3933156042-2316999077-2687276773-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3933156042-2316999077-2687276773-1000\Control Panel\International\Geo\Nation	Winver.exe

Executes dropped EXE 1 IoCs

pid	Process
3780	Winver.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\RuntimeBroker.exe	Winver.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\9e8d7a4ca61bd9	Winver.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe	Winver.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\9e8d7a4ca61bd9	Winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1168	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3933156042-2316999077-2687276773-1000_Classes\Local Settings	1.exe
Key created	\REGISTRY\USER\S-1-5-21-3933156042-2316999077-2687276773-1000_Classes\Local Settings	Winver.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1168	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3400	schtasks.exe
4092	schtasks.exe
4724	schtasks.exe
4396	schtasks.exe
2904	schtasks.exe
3688	schtasks.exe
1128	schtasks.exe
3060	schtasks.exe
4864	schtasks.exe
4752	schtasks.exe
4976	schtasks.exe
3680	schtasks.exe
4956	schtasks.exe
2552	schtasks.exe
5044	schtasks.exe
2996	schtasks.exe
4044	schtasks.exe
4860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe
3780	Winver.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3780	Winver.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 644	5084	1.exe	84
PID 5084 wrote to memory of 644	5084	1.exe	84
PID 5084 wrote to memory of 644	5084	1.exe	84
PID 644 wrote to memory of 5104	644	WScript.exe	85
PID 644 wrote to memory of 5104	644	WScript.exe	85
PID 644 wrote to memory of 5104	644	WScript.exe	85
PID 5104 wrote to memory of 3780	5104	cmd.exe	87
PID 5104 wrote to memory of 3780	5104	cmd.exe	87
PID 3780 wrote to memory of 4756	3780	Winver.exe	107
PID 3780 wrote to memory of 4756	3780	Winver.exe	107
PID 4756 wrote to memory of 2652	4756	cmd.exe	109
PID 4756 wrote to memory of 2652	4756	cmd.exe	109
PID 4756 wrote to memory of 1168	4756	cmd.exe	110
PID 4756 wrote to memory of 1168	4756	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ESD\r9FE9AzSI.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\ESD\Winver.exe
      "C:\ESD/Winver.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3780
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NrV2HCf3oD.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4756
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2652
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Desktop\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Desktop\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinverW" /sc MINUTE /mo 8 /tr "'C:\ESD\Winver.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Winver" /sc ONLOGON /tr "'C:\ESD\Winver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinverW" /sc MINUTE /mo 12 /tr "'C:\ESD\Winver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe

Filesize
190B

MD5
e652dbefdc14989c6c143840598688fc

SHA1
f7f8bd9277540b5dfe61608f9cc294677c235d9c

SHA256
931f80ee9a44026f30b6f243c4a4b77c344d1c039548ca29028822bc8608f80c

SHA512
99bc14f9515b438bb9c530b5785ab45d49ebcae6cd2e6dc8ace02c7adacd34eae576318db901e059092e596b2592334eeaceb675e9f887caa9a1c1cfe55837ed

Download Submit
C:\ESD\Winver.exe

Filesize
1.8MB

MD5
d4f263a3feebfe196d5eceb651c9ffb7

SHA1
dde163a9747f48004ed85777ced25062b16c62d7

SHA256
c91143795474ec192096650cddcacd5d4e0d46b384e8a56dab7ca029ac2a7d43

SHA512
f933264ab7fe364946619938a6997566f583f69a8d75698da4ad77833ce9e4514153fc5d54477fd9e19ae12e5b7fe19bdbc2a2c17a51d53f3c632a48635aa967

Download Submit
C:\ESD\r9FE9AzSI.bat

Filesize
70B

MD5
49df7cd2be033c4b1f2de946daeb968b

SHA1
3c6fda5eda780f3f7016ebf969697b8f365d06fd

SHA256
6a8c02efc7143f4ee54e6e13a10050b525d265e0b5fcad04510eeae61e6561cd

SHA512
cc4bb5b8c22a65e4b2c6ffa1dfcaea0a97fd651aa6d39922b461ee33a95fbd3c11246808d416ad16f570a882f4d77bb2cc851421d39f4caf92155e28dc1e5b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\NrV2HCf3oD.bat

Filesize
182B

MD5
3ad780f504b6a744ef4e8448a3895fa1

SHA1
8a9c44de205d22d488fac29737db93ed06529430

SHA256
0b2b08db6df2cb45386586d68d82afd0303276a339b1d6670df98ee3154229b1

SHA512
40daadf1ef62b2ce8d5a221eafbadf782d63949cc1e61aca025186c724242ae20f3d2a57593d3e19818a97503341a6d9350d8c745dba8ebe7edea827bd3dcfa8

Download Submit
memory/3780-15-0x00007FFEB95C3000-0x00007FFEB95C5000-memory.dmp

Filesize
8KB

Download
memory/3780-16-0x0000000000A10000-0x0000000000BE2000-memory.dmp

Filesize
1.8MB

Download
memory/3780-18-0x0000000002DE0000-0x0000000002DEE000-memory.dmp

Filesize
56KB

Download
memory/3780-20-0x0000000002E20000-0x0000000002E3C000-memory.dmp

Filesize
112KB

Download
memory/3780-21-0x000000001B8A0000-0x000000001B8F0000-memory.dmp

Filesize
320KB

Download
memory/3780-23-0x0000000002E40000-0x0000000002E58000-memory.dmp

Filesize
96KB

Download