dcrat | 777f77c1c53c3551c89ef44c86c06cbfe0b2bb04374b7d7d9f6153d3ecc3c267

Analysis

max time kernel
127s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

415b778406bbdc705f1962ded94e90d0.exe
Size

984KB
MD5

415b778406bbdc705f1962ded94e90d0
SHA1

978d2e0051ce04c78f60f312a9389d31ed346d82
SHA256

77c664a6cd94c282ecfa0c4f8fa7b101dee5a74b424fbfee3290a9d0315a1bfe
SHA512

d11ef00e5661474983be3d32afc695d9eeb5fbddefb99c05b5d84d6bb85cdafde98ff34d07a65c2b36adb0b6d93ce25111b2cea59ccc6dea65682580d5ddd3a9
SSDEEP

12288:LzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:LzZvuGD2PvA5YxwmbZB6Uv

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4912	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	4912	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	4912	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	4912	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	4912	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	4912	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	4912	schtasks.exe	89

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	415b778406bbdc705f1962ded94e90d0.exe

Executes dropped EXE 1 IoCs

pid	Process
4636	lsass.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\fontdrvhost.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\bootstat\\sysmon.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\SuggestionUI\\TextInputHost.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Documents and Settings\\explorer.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\dwm.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\3ac54ddf2ad44faa6035cf\\lsass.exe\""	415b778406bbdc705f1962ded94e90d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Documents and Settings\\smss.exe\""	415b778406bbdc705f1962ded94e90d0.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\5b884080fd4f94	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCXDF96.tmp	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\dwm.exe	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXE631.tmp	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\dwm.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\6cb0b6c459d5d3	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe	415b778406bbdc705f1962ded94e90d0.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\bootstat\sysmon.exe	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\bootstat\sysmon.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\bootstat\121e5b5079f7c0	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe	415b778406bbdc705f1962ded94e90d0.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\22eafd247d37c3	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\bootstat\RCXD988.tmp	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\RCXDB8D.tmp	415b778406bbdc705f1962ded94e90d0.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe	415b778406bbdc705f1962ded94e90d0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	415b778406bbdc705f1962ded94e90d0.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4496	schtasks.exe
4372	schtasks.exe
3092	schtasks.exe
4980	schtasks.exe
1884	schtasks.exe
4168	schtasks.exe
1032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4740	415b778406bbdc705f1962ded94e90d0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	415b778406bbdc705f1962ded94e90d0.exe
Token: SeDebugPrivilege	4636	lsass.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2676	4740	415b778406bbdc705f1962ded94e90d0.exe	100
PID 4740 wrote to memory of 2676	4740	415b778406bbdc705f1962ded94e90d0.exe	100
PID 2676 wrote to memory of 4484	2676	cmd.exe	102
PID 2676 wrote to memory of 4484	2676	cmd.exe	102
PID 2676 wrote to memory of 4636	2676	cmd.exe	105
PID 2676 wrote to memory of 4636	2676	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\415b778406bbdc705f1962ded94e90d0.exe
"C:\Users\Admin\AppData\Local\Temp\415b778406bbdc705f1962ded94e90d0.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SVqzAbEMAy.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4484
- - C:\3ac54ddf2ad44faa6035cf\lsass.exe
    "C:\3ac54ddf2ad44faa6035cf\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\bootstat\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\3ac54ddf2ad44faa6035cf\lsass.exe

Filesize
984KB

MD5
415b778406bbdc705f1962ded94e90d0

SHA1
978d2e0051ce04c78f60f312a9389d31ed346d82

SHA256
77c664a6cd94c282ecfa0c4f8fa7b101dee5a74b424fbfee3290a9d0315a1bfe

SHA512
d11ef00e5661474983be3d32afc695d9eeb5fbddefb99c05b5d84d6bb85cdafde98ff34d07a65c2b36adb0b6d93ce25111b2cea59ccc6dea65682580d5ddd3a9

Download Submit
C:\3ac54ddf2ad44faa6035cf\lsass.exe

Filesize
984KB

MD5
843e1805414d93589b167d725ae0d767

SHA1
0c23bbcfd97a9627d414f321261b1a4cbe46411c

SHA256
46536b9daa5c8aa1fa9bc88571930633c2f3d08c73813c28c619807e0e6101d7

SHA512
0ef0edfb4ca9a2346d1d3648cdb48e7ab58cc26cdba5fe321f55023bc3545fa791af3bdec1423f929d140da19ce87af8a9c03bdd04f121691529a9a7c4b4d722

Download Submit
C:\Users\Admin\AppData\Local\Temp\SVqzAbEMAy.bat

Filesize
199B

MD5
72b8953b03b7757ac9db5e09e7a7ce22

SHA1
c9cebf3046ca8d731d64e16990988b1aebcf13e9

SHA256
fd89aa23523434f522bbb9fcd4a1471191c97ba23de6d7682feb4aa9fc70d611

SHA512
afd8dec647b0f3c277271cf1fcb89ef273ee89a285f55f9bf37de95cbb69864d206c64edb30d38a041abff1e084d68302e6ae96319a0fcf15ebd45247ee3e4c7

Download Submit
memory/4636-88-0x000000001C5D0000-0x000000001C5E2000-memory.dmp

Filesize
72KB

Download
memory/4636-87-0x00000000006C0000-0x00000000007BC000-memory.dmp

Filesize
1008KB

Download
memory/4740-6-0x000000001B3C0000-0x000000001B3D0000-memory.dmp

Filesize
64KB

Download
memory/4740-12-0x000000001B470000-0x000000001B47C000-memory.dmp

Filesize
48KB

Download
memory/4740-7-0x000000001B3D0000-0x000000001B3D8000-memory.dmp

Filesize
32KB

Download
memory/4740-0-0x00007FFBB4D03000-0x00007FFBB4D05000-memory.dmp

Filesize
8KB

Download
memory/4740-9-0x000000001B3F0000-0x000000001B3FC000-memory.dmp

Filesize
48KB

Download
memory/4740-10-0x000000001B400000-0x000000001B412000-memory.dmp

Filesize
72KB

Download
memory/4740-11-0x000000001C1E0000-0x000000001C708000-memory.dmp

Filesize
5.2MB

Download
memory/4740-8-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

Filesize
64KB

Download
memory/4740-4-0x000000001B420000-0x000000001B470000-memory.dmp

Filesize
320KB

Download
memory/4740-82-0x00007FFBB4D00000-0x00007FFBB57C1000-memory.dmp

Filesize
10.8MB

Download
memory/4740-5-0x00000000028D0000-0x00000000028E0000-memory.dmp

Filesize
64KB

Download
memory/4740-3-0x0000000002810000-0x000000000282C000-memory.dmp

Filesize
112KB

Download
memory/4740-2-0x00007FFBB4D00000-0x00007FFBB57C1000-memory.dmp

Filesize
10.8MB

Download
memory/4740-1-0x00000000006B0000-0x00000000007AC000-memory.dmp

Filesize
1008KB

Download