dcrat | 777f77c1c53c3551c89ef44c86c06cbfe0b2bb04374b7d7d9f6153d3ecc3c267

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

415b778406bbdc705f1962ded94e90d0.exe
Size

984KB
MD5

415b778406bbdc705f1962ded94e90d0
SHA1

978d2e0051ce04c78f60f312a9389d31ed346d82
SHA256

77c664a6cd94c282ecfa0c4f8fa7b101dee5a74b424fbfee3290a9d0315a1bfe
SHA512

d11ef00e5661474983be3d32afc695d9eeb5fbddefb99c05b5d84d6bb85cdafde98ff34d07a65c2b36adb0b6d93ce25111b2cea59ccc6dea65682580d5ddd3a9
SSDEEP

12288:LzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:LzZvuGD2PvA5YxwmbZB6Uv

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 12 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
File created	C:\Windows\System32\MsCtfMonitor\101b941d020240		415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\MsCtfMonitor\lsm.exe		415b778406bbdc705f1962ded94e90d0.exe
		2824	schtasks.exe
		2248	schtasks.exe
		2804	schtasks.exe
		3028	schtasks.exe
		2724	schtasks.exe
		2708	schtasks.exe
		2520	schtasks.exe
		1096	schtasks.exe
		2612	schtasks.exe
		2712	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2104	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2104	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2104	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2104	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2104	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2104	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2104	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2104	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2104	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2104	schtasks.exe	31

Executes dropped EXE 1 IoCs

pid	Process
1568	lsm.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\MsCtfMonitor\\lsm.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\spoolsv.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\lsm.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\drvinst\\WmiPrvSE.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\System32\\tapiui\\services.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\bootstr\\lsm.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\wininit.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\api-ms-win-core-heap-l1-1-0\\spoolsv.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\explorer.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\mfc110fra\\csrss.exe\""	415b778406bbdc705f1962ded94e90d0.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File created	C:\Windows\System32\bootstr\101b941d020240	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\MsCtfMonitor\RCXCDFA.tmp	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\api-ms-win-core-heap-l1-1-0\RCXD202.tmp	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\wbem\drvinst\RCXDAEB.tmp	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\bootstr\lsm.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\MsCtfMonitor\lsm.exe	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\MsCtfMonitor\lsm.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\api-ms-win-core-heap-l1-1-0\f3b6ecef712a24	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\wbem\drvinst\WmiPrvSE.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\wbem\drvinst\24dbde2999530e	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\mfc110fra\RCXDEF3.tmp	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\mfc110fra\csrss.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\MsCtfMonitor\101b941d020240	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\mfc110fra\csrss.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\mfc110fra\886983d96e3d3e	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\wbem\drvinst\WmiPrvSE.exe	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\tapiui\RCXDCEF.tmp	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\bootstr\RCXE0F7.tmp	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\api-ms-win-core-heap-l1-1-0\spoolsv.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\tapiui\services.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\System32\tapiui\c5b4cb5e9653cc	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\api-ms-win-core-heap-l1-1-0\spoolsv.exe	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\tapiui\services.exe	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\System32\bootstr\lsm.exe	415b778406bbdc705f1962ded94e90d0.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RCXD473.tmp	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\explorer.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\explorer.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\7a0fd90576e088	415b778406bbdc705f1962ded94e90d0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2248	schtasks.exe
3028	schtasks.exe
2724	schtasks.exe
2824	schtasks.exe
1096	schtasks.exe
2612	schtasks.exe
2712	schtasks.exe
2804	schtasks.exe
2708	schtasks.exe
2520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2080	415b778406bbdc705f1962ded94e90d0.exe
2080	415b778406bbdc705f1962ded94e90d0.exe
2080	415b778406bbdc705f1962ded94e90d0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	415b778406bbdc705f1962ded94e90d0.exe
Token: SeDebugPrivilege	1568	lsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2920	2080	415b778406bbdc705f1962ded94e90d0.exe	42
PID 2080 wrote to memory of 2920	2080	415b778406bbdc705f1962ded94e90d0.exe	42
PID 2080 wrote to memory of 2920	2080	415b778406bbdc705f1962ded94e90d0.exe	42
PID 2920 wrote to memory of 2976	2920	cmd.exe	44
PID 2920 wrote to memory of 2976	2920	cmd.exe	44
PID 2920 wrote to memory of 2976	2920	cmd.exe	44
PID 2920 wrote to memory of 1568	2920	cmd.exe	45
PID 2920 wrote to memory of 1568	2920	cmd.exe	45
PID 2920 wrote to memory of 1568	2920	cmd.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\415b778406bbdc705f1962ded94e90d0.exe
"C:\Users\Admin\AppData\Local\Temp\415b778406bbdc705f1962ded94e90d0.exe"
1⤵
- DcRat
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VbLUk798pC.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2976
- - C:\Windows\System32\MsCtfMonitor\lsm.exe
    "C:\Windows\System32\MsCtfMonitor\lsm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\MsCtfMonitor\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\api-ms-win-core-heap-l1-1-0\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\drvinst\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\tapiui\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\mfc110fra\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\bootstr\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\RCXD8E7.tmp

Filesize
984KB

MD5
bd4bad94b32c1604842be5e4698f2c59

SHA1
1eb7a1bc1788c440dceb04ed6fdb5cf10e2fafc0

SHA256
49e28421d6222869ccaa38ab89ac43522eca63952192d086d125c2f48897a437

SHA512
6418e6cb2a72697b5e34d84920cab5c53bd83ac533fb43cb900ab7cd96fca4009e2e31b89867af27f680a3e8a430705678bd4dca71ae00fe10999caed3472e57

Download Submit
C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe

Filesize
984KB

MD5
415b778406bbdc705f1962ded94e90d0

SHA1
978d2e0051ce04c78f60f312a9389d31ed346d82

SHA256
77c664a6cd94c282ecfa0c4f8fa7b101dee5a74b424fbfee3290a9d0315a1bfe

SHA512
d11ef00e5661474983be3d32afc695d9eeb5fbddefb99c05b5d84d6bb85cdafde98ff34d07a65c2b36adb0b6d93ce25111b2cea59ccc6dea65682580d5ddd3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\VbLUk798pC.bat

Filesize
204B

MD5
26f89adfa52a4885b6e0bbda4dbd18df

SHA1
4b360292789d23e9742ae8c0f9e7be8e35033563

SHA256
c4dcb0467dc7832e9d6cc754f906a33e00625360e32e19bd96be537d7be60651

SHA512
611e3b5d7b14a10e7114579abfb7fc515550dd2df195af7c2a75a872699eb584891650a581384ae74901ffa851d4cf93bdb96b3759fca24587b7aa99c0d0bfce

Download Submit
C:\Windows\System32\bootstr\RCXE0F7.tmp

Filesize
984KB

MD5
9f5ca519ab9295ef053bd48ac7b9395c

SHA1
e889c55dcff1c7e2722700876bfc232547efd3ea

SHA256
d9fb735005745b5b17a8fa9283a9d908ac3b6c4b102b9050bd7a9972397193a5

SHA512
553c1f4b4cdfd13bcd539a49e5658e87f264afc8c6f18ecf9b2d4e8f7f53bfc8b150d96828e2c7fe6850c0d74d912dbb4215016a43c0b4a4714ba8ad8f694035

Download Submit
memory/1568-111-0x00000000005E0000-0x00000000005F2000-memory.dmp

Filesize
72KB

Download
memory/1568-110-0x0000000000360000-0x000000000045C000-memory.dmp

Filesize
1008KB

Download
memory/2080-4-0x0000000000650000-0x0000000000660000-memory.dmp

Filesize
64KB

Download
memory/2080-7-0x00000000006A0000-0x00000000006B0000-memory.dmp

Filesize
64KB

Download
memory/2080-8-0x0000000000680000-0x000000000068C000-memory.dmp

Filesize
48KB

Download
memory/2080-9-0x0000000000690000-0x00000000006A2000-memory.dmp

Filesize
72KB

Download
memory/2080-10-0x0000000000B70000-0x0000000000B7C000-memory.dmp

Filesize
48KB

Download
memory/2080-6-0x0000000000670000-0x0000000000678000-memory.dmp

Filesize
32KB

Download
memory/2080-5-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/2080-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2080-3-0x0000000000340000-0x000000000035C000-memory.dmp

Filesize
112KB

Download
memory/2080-107-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-1-0x0000000001200000-0x00000000012FC000-memory.dmp

Filesize
1008KB

Download