dcrat | 1193157e2a338dbe8d057b125d36fffd2c05be694c1bfdaaf49d52e30bd08ebd

Analysis

max time kernel
146s
max time network
148s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11/03/2025, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coderoom-main/nbvtojsdawh.exe
Size 1.3MB
Sample250311-tp2gvsxpv2
SHA256 cb888774ee7f7ddf235b38e08b267ddb86bd9458b6e8701593a871977033e3f3
MD5 347f809ee23c43c837f31a1f3faea31e
SHA1 483ce5fd414d27c0db77a62082ca9eac9417e618
SHA512 718817ddb5a5ed4a2a77bf00fc3979e5904cb4eb1a85682172ce738dd652498ac8586223d92da2bfe81508042266db3d84f39d56ef8b6b9290f020132c910111
SSDEEP 12288:UDN1ULnJjGfpoAJiy8/PoiMWOLonc8EvrHaFykDsdj9HdP97pqI0wD9GqzsahPq6:UhIslJT8/v8ku5L8KTD+oiQrr/61+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral17/memory/1164-1-0x0000000000430000-0x0000000000584000-memory.dmp	family_dcrat_v2
behavioral17/files/0x000c000000027df8-39.dat	family_dcrat_v2

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000\Control Panel\International\Geo\Nation	nbvtojsdawh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000\Control Panel\International\Geo\Nation	staticfile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000\Control Panel\International\Geo\Nation	staticfile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000\Control Panel\International\Geo\Nation	staticfile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000\Control Panel\International\Geo\Nation	staticfile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000\Control Panel\International\Geo\Nation	staticfile.exe

Executes dropped EXE 5 IoCs

pid	Process
440	staticfile.exe
2176	staticfile.exe
5024	staticfile.exe
824	staticfile.exe
4304	staticfile.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2224	PING.EXE
4436	PING.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000_Classes\Local Settings	nbvtojsdawh.exe
Key created	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000_Classes\Local Settings	staticfile.exe
Key created	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000_Classes\Local Settings	staticfile.exe
Key created	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000_Classes\Local Settings	staticfile.exe
Key created	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000_Classes\Local Settings	staticfile.exe
Key created	\REGISTRY\USER\S-1-5-21-3996797005-1442104920-3698332314-1000_Classes\Local Settings	staticfile.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2224	PING.EXE
4436	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe
1164	nbvtojsdawh.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	nbvtojsdawh.exe
Token: SeDebugPrivilege	440	staticfile.exe
Token: SeDebugPrivilege	2176	staticfile.exe
Token: SeDebugPrivilege	5024	staticfile.exe
Token: SeDebugPrivilege	824	staticfile.exe
Token: SeDebugPrivilege	4304	staticfile.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 696	1164	nbvtojsdawh.exe	84
PID 1164 wrote to memory of 696	1164	nbvtojsdawh.exe	84
PID 696 wrote to memory of 1056	696	cmd.exe	86
PID 696 wrote to memory of 1056	696	cmd.exe	86
PID 696 wrote to memory of 4260	696	cmd.exe	87
PID 696 wrote to memory of 4260	696	cmd.exe	87
PID 696 wrote to memory of 440	696	cmd.exe	92
PID 696 wrote to memory of 440	696	cmd.exe	92
PID 440 wrote to memory of 692	440	staticfile.exe	96
PID 440 wrote to memory of 692	440	staticfile.exe	96
PID 692 wrote to memory of 1920	692	cmd.exe	98
PID 692 wrote to memory of 1920	692	cmd.exe	98
PID 692 wrote to memory of 2224	692	cmd.exe	99
PID 692 wrote to memory of 2224	692	cmd.exe	99
PID 692 wrote to memory of 2176	692	cmd.exe	101
PID 692 wrote to memory of 2176	692	cmd.exe	101
PID 2176 wrote to memory of 1424	2176	staticfile.exe	102
PID 2176 wrote to memory of 1424	2176	staticfile.exe	102
PID 1424 wrote to memory of 2512	1424	cmd.exe	104
PID 1424 wrote to memory of 2512	1424	cmd.exe	104
PID 1424 wrote to memory of 3328	1424	cmd.exe	105
PID 1424 wrote to memory of 3328	1424	cmd.exe	105
PID 1424 wrote to memory of 5024	1424	cmd.exe	106
PID 1424 wrote to memory of 5024	1424	cmd.exe	106
PID 5024 wrote to memory of 3264	5024	staticfile.exe	107
PID 5024 wrote to memory of 3264	5024	staticfile.exe	107
PID 3264 wrote to memory of 1188	3264	cmd.exe	109
PID 3264 wrote to memory of 1188	3264	cmd.exe	109
PID 3264 wrote to memory of 4436	3264	cmd.exe	110
PID 3264 wrote to memory of 4436	3264	cmd.exe	110
PID 3264 wrote to memory of 824	3264	cmd.exe	111
PID 3264 wrote to memory of 824	3264	cmd.exe	111
PID 824 wrote to memory of 1128	824	staticfile.exe	112
PID 824 wrote to memory of 1128	824	staticfile.exe	112
PID 1128 wrote to memory of 1664	1128	cmd.exe	114
PID 1128 wrote to memory of 1664	1128	cmd.exe	114
PID 1128 wrote to memory of 2468	1128	cmd.exe	115
PID 1128 wrote to memory of 2468	1128	cmd.exe	115
PID 1128 wrote to memory of 4304	1128	cmd.exe	116
PID 1128 wrote to memory of 4304	1128	cmd.exe	116
PID 4304 wrote to memory of 1972	4304	staticfile.exe	117
PID 4304 wrote to memory of 1972	4304	staticfile.exe	117
PID 1972 wrote to memory of 3184	1972	cmd.exe	119
PID 1972 wrote to memory of 3184	1972	cmd.exe	119
PID 1972 wrote to memory of 3128	1972	cmd.exe	120
PID 1972 wrote to memory of 3128	1972	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\coderoom-main\nbvtojsdawh.exe
"C:\Users\Admin\AppData\Local\Temp\coderoom-main\nbvtojsdawh.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m9AOBI3bnY.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1056
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4260
- - C:\Users\Admin\AppData\Local\staticfile.exe
    "C:\Users\Admin\AppData\Local\staticfile.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A3WMu9vzZU.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:692
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1920
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2176
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z0hIbOJQ8t.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nhkbaghNki.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1188
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HGbZHomwPb.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\O68ilSTvi1.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3184
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

staticfile.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\staticfile.exe.log
Size 1KB
SHA256 7503b24e32b066efbacb33743a25348bcd9be003184bae2b081cf0966f58a765
MD5 eca7dc4af79fd0a8dfea78b461bdb9d5
SHA1 a822533ec60cb99ca8439cb0fc82a4c170856926
SHA512 81f9c3d89398b57a9ad62ab8b224470632a5e858cc386b43dcfbbade40f6ed135133b928819a5481e4403264ccb92a59148d514c6582822015af6bb132bd6849
MD5 SHA1 SHA512

Submit Download

A3WMu9vzZU.bat

Path C:\Users\Admin\AppData\Local\Temp\A3WMu9vzZU.bat
Size 171B
SHA256 c72477c7bde327b572e32191b31579e3f776e8c17661558d63443f57c7818d2e
MD5 3a2a09d6fa33f4c610a8e715b9c53ae3
SHA1 9501e2bbed6e6cdab53b70acff7559c7840deab5
SHA512 f859d97367fccdc97afb1bf726091ed3d30ed204a66e1431aab5861988077801ea5d3993d42896d3dc0973abab97f30f060ad8fbc9154a472f16c5da9827e7f4
MD5 SHA1 SHA512

Submit Download

HGbZHomwPb.bat

Path C:\Users\Admin\AppData\Local\Temp\HGbZHomwPb.bat
Size 219B
SHA256 6084e8473601e7662b54510e622fb1f5ac64aeecd8508a3ce01c4cb23f72234c
MD5 5b660b431b3f7dc8183fe01a94baf646
SHA1 4a579f85932a6fff1fa67a058ecb485907c5a26f
SHA512 0ae971d96aafd9d730c015e98b30caa2d7841c5ab20a49815cf5033611c5ca365e1da0cea81a2b14b12ab979a2c38ac015357e2643c1fc4d986dc25d407d236e
MD5 SHA1 SHA512

Submit Download

O68ilSTvi1.bat

Path C:\Users\Admin\AppData\Local\Temp\O68ilSTvi1.bat
Size 219B
SHA256 6ff452cc669767af18cc6bac31098d17735dcea33f3f695b63545d6b0d8f8015
MD5 e69770cdb984175acb720f0d04ee407c
SHA1 e5daa9dbba2ff601dafc6f2c02f5a401d513356a
SHA512 72fa1c4d16fbc8c0c99ff82d24b0b6894077ecf6ceb9f04f6ca9e409fbe351f0dd65560b875b3fb29c68c8e8513779f143dc464a2d9c7fc8bcd4751545f37211
MD5 SHA1 SHA512

Submit Download

Z0hIbOJQ8t.bat

Path C:\Users\Admin\AppData\Local\Temp\Z0hIbOJQ8t.bat
Size 219B
SHA256 38926d164870a3c9cd51a3d137e95bc360aa361ae9cacd603f5038552c317556
MD5 04a04d30cc6e57c8bfd0604bb877c048
SHA1 7e64701526cd56d50b173f675dd5fcfd53c4f6ae
SHA512 245c4c537152455a550ee773cd9512372897ee95c8830091ddf2b5859af2e1068e21b3e12542c3426fae8b3d0ed316f28f2c0f27a11e8cc92a956e06183aaeb8
MD5 SHA1 SHA512

Submit Download

m9AOBI3bnY.bat

Path C:\Users\Admin\AppData\Local\Temp\m9AOBI3bnY.bat
Size 219B
SHA256 a1beb9232cf783dc4d798733545a876477bc32168fcaef1471f7d04bed2522a1
MD5 149e5ea4d4ccf7902e0e5ee588d9aa97
SHA1 d542ef00c9be767ae1bfdccdb0fb6075a678e8fd
SHA512 ad2ca488725280b0d12a3847ee3f494048597715a6088b6f6ef8967448002fd1341054e383925023099b8aca0df3e7ed7f4bcabd4d83cf9fb75402ffc20a25fc
MD5 SHA1 SHA512

Submit Download

nhkbaghNki.bat

Path C:\Users\Admin\AppData\Local\Temp\nhkbaghNki.bat
Size 171B
SHA256 94bde01039a19d3cfd4202cd1dab46fd4e6a2e929c1e967abbd614b740925e7c
MD5 2f9c29958a324fe7334787e39f7d7e09
SHA1 f3c71ba23576a1e032648fe6aa6df64669240dc0
SHA512 cee0845e3dacef74ced3a10e04f177b7f6de105f05d8b5a6da6b56d1e02bda51eb02096c6fa8c0c09499edb853fe9834f5ba164847d2b0502b98685ac7cfaa39
MD5 SHA1 SHA512

Submit Download

staticfile.exe

Path C:\Users\Admin\AppData\Local\staticfile.exe
Size 1.3MB
SHA256 cb888774ee7f7ddf235b38e08b267ddb86bd9458b6e8701593a871977033e3f3
MD5 347f809ee23c43c837f31a1f3faea31e
SHA1 483ce5fd414d27c0db77a62082ca9eac9417e618
SHA512 718817ddb5a5ed4a2a77bf00fc3979e5904cb4eb1a85682172ce738dd652498ac8586223d92da2bfe81508042266db3d84f39d56ef8b6b9290f020132c910111
SSDEEP 12288:UDN1ULnJjGfpoAJiy8/PoiMWOLonc8EvrHaFykDsdj9HdP97pqI0wD9GqzsahPq6:UhIslJT8/v8ku5L8KTD+oiQrr/61+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/824-113-0x000000001BAB0000-0x000000001BB51000-memory.dmp

Download

memory/1164-12-0x0000000000D60000-0x0000000000D6C000-memory.dmp

Download

memory/1164-37-0x00007FFCC0700000-0x00007FFCC11C2000-memory.dmp

Download

memory/1164-17-0x0000000000D70000-0x0000000000D80000-memory.dmp

Download

memory/1164-19-0x0000000002800000-0x0000000002812000-memory.dmp

Download

memory/1164-20-0x00007FFCC0700000-0x00007FFCC11C2000-memory.dmp

Download

memory/1164-21-0x00007FFCC0700000-0x00007FFCC11C2000-memory.dmp

Download

memory/1164-24-0x000000001B260000-0x000000001B2BA000-memory.dmp

Download

memory/1164-22-0x000000001B730000-0x000000001BC58000-memory.dmp

Download

memory/1164-27-0x00007FFCC0700000-0x00007FFCC11C2000-memory.dmp

Download

memory/1164-26-0x000000001B200000-0x000000001B218000-memory.dmp

Download

memory/1164-14-0x00000000027C0000-0x00000000027D2000-memory.dmp

Download

memory/1164-15-0x00007FFCC0700000-0x00007FFCC11C2000-memory.dmp

Download

memory/1164-10-0x00007FFCC0700000-0x00007FFCC11C2000-memory.dmp

Download

memory/1164-0-0x00007FFCC0703000-0x00007FFCC0705000-memory.dmp

Download

memory/1164-9-0x0000000000D40000-0x0000000000D4E000-memory.dmp

Download

memory/1164-7-0x0000000002740000-0x0000000002758000-memory.dmp

Download

memory/1164-6-0x00007FFCC0700000-0x00007FFCC11C2000-memory.dmp

Download

memory/1164-1-0x0000000000430000-0x0000000000584000-memory.dmp

Download

memory/1164-4-0x0000000000D30000-0x0000000000D3E000-memory.dmp

Download

memory/1164-2-0x00007FFCC0700000-0x00007FFCC11C2000-memory.dmp

Download

memory/4304-132-0x000000001C4E0000-0x000000001C687000-memory.dmp

Download

memory/5024-94-0x000000001C590000-0x000000001C631000-memory.dmp

Download