dcrat | ed57b772d3d924dbab826fe02d792324982f5d92e88d09afc1a734173b88599d

General

Target

CFlowBeta (1).exe
Size

3.5MB
MD5

7f3cc1233ea7a9a2fee1b51620e2b647
SHA1

3c40f2a0c0dc6e5f9379352751d87ba452221664
SHA256

ed57b772d3d924dbab826fe02d792324982f5d92e88d09afc1a734173b88599d
SHA512

095f97337db0a650757ea4b1df3f45ef711baf5f7892aec89c824e83ccf64f9f749a4ca6b5c38cbb5ff3e1c093d4f6735a25399b5b394c0932e8c3cf403979ce
SSDEEP

98304:IbUi+JjIHeo5n3YMM5N+RjvagClBA1eVTzF:IeEHe9Mux18QVT5

Score

10^/10

dcrat defense_evasion discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000a000000023c24-10.dat	dcrat
behavioral1/memory/2720-13-0x00000000005B0000-0x00000000008D4000-memory.dmp	dcrat

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation	CFlowBeta (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2720	HyperDllcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CFlowBeta (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings	CFlowBeta (1).exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2812	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	HyperDllcommon.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 2604	4172	CFlowBeta (1).exe	86
PID 4172 wrote to memory of 2604	4172	CFlowBeta (1).exe	86
PID 4172 wrote to memory of 2604	4172	CFlowBeta (1).exe	86
PID 2604 wrote to memory of 4716	2604	WScript.exe	87
PID 2604 wrote to memory of 4716	2604	WScript.exe	87
PID 2604 wrote to memory of 4716	2604	WScript.exe	87
PID 4716 wrote to memory of 2720	4716	cmd.exe	89
PID 4716 wrote to memory of 2720	4716	cmd.exe	89
PID 4716 wrote to memory of 2812	4716	cmd.exe	91
PID 4716 wrote to memory of 2812	4716	cmd.exe	91
PID 4716 wrote to memory of 2812	4716	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\CFlowBeta (1).exe
"C:\Users\Admin\AppData\Local\Temp\CFlowBeta (1).exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BridgeDriversavesIntoref\MDZuiXGHF6DSL.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BridgeDriversavesIntoref\cjJU4QO.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\BridgeDriversavesIntoref\HyperDllcommon.exe
      "C:\BridgeDriversavesIntoref\HyperDllcommon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2720
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BridgeDriversavesIntoref\HyperDllcommon.exe

Filesize
3.1MB

MD5
e787fdcbf81593297b23533eb887bb0d

SHA1
0534ffe024b83acefe4c71bdd3e6476e72b82564

SHA256
adba7079c2f8527c8677c189f80a241754c64869b9f52adb60c737938a129e99

SHA512
8fd1877bb58ce9ea09bd8d3eadc984f341086e15f59f4e22bb834430a4c6732238638fe435cce6153f965f5e9ee879739fbe0f9e424125b1f8c8b28cd2d4276c

Download Submit
C:\BridgeDriversavesIntoref\MDZuiXGHF6DSL.vbe

Filesize
208B

MD5
73ab70ceaa0f998f770a136d914e641e

SHA1
63f81a7fd2106432458f132870e4ee36eeaca7ac

SHA256
09f11c16faf296001faeb6cfc2ea6a34bcfd40108fd54ff3948d039eedd6c68f

SHA512
f0e8786319f42582515a0acbd9c758f122e576383c7b2b79d25a050c9d93b6e60d814b07409a9ede0997dfadac6760217a043ee6fb16d9be1faeddeb9cf3aa5d

Download Submit
C:\BridgeDriversavesIntoref\cjJU4QO.bat

Filesize
160B

MD5
ac20d72dcc5e68fbd6e73f5d3a2b4a01

SHA1
c931e8bbcfdc4299b70859e666c577c1e5b7c1cf

SHA256
8b60f1936f10b03b4cbc9ee0a4916e813e6d7ff63ef55326c61cb31b57b1f18c

SHA512
9b5d7f1bd7932d0ecaf69bbd1a58b466e802bddba9585ec0380033ae6565693850e7d8ce6367ab346aebeea4d66822199254f646376fdb9a5076a2d0efb887cc

Download Submit
memory/2720-12-0x00007FFE26453000-0x00007FFE26455000-memory.dmp

Filesize
8KB

Download
memory/2720-13-0x00000000005B0000-0x00000000008D4000-memory.dmp

Filesize
3.1MB

Download
memory/2720-14-0x0000000001110000-0x000000000111E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing