dcrat | 6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88

Analysis

max time kernel
121s
max time network
149s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
26/03/2025, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe
Size

1.8MB
MD5

3386e2abdfb0d9549bfba2cce6ca7689
SHA1

ed6cb1b6d742f644ea2d1450c84a715d0b342d5c
SHA256

6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88
SHA512

8f5af4ba0f985ef0b2ebb0a1518f07ad39feac4c355587fa4b1db093d8f763bff4484488a7692550fa458499af696dc2d09c54266a7a2ecfe1340de97eacf8de
SSDEEP

49152:TRWp/PzUuHrGdkuxEiRMmWqf2/wzfUMrf5yfdoP+krDDjJOeZs:TEJPzXHrGdkuWJmWZ4CfdoPhXJOk

Score

10^/10

dcrat stormkitty xworm discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

89.39.121.169:9000

Attributes

Install_directory
%AppData%
install_file
RunShell.exe

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001202c-10.dat	family_xworm
behavioral1/memory/2632-20-0x00000000008E0000-0x00000000008F6000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x002c000000015d0e-13.dat	family_stormkitty
behavioral1/memory/2820-31-0x0000000000FF0000-0x0000000001034000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 5 IoCs

pid	Process
2632	XClient.exe
2820	Build.exe
2688	DCRatBuild.exe
2344	fontWinnet.exe
1672	taskhost.exe

Loads dropped DLL 7 IoCs

pid	Process
300	cmd.exe
300	cmd.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipinfo.io
7	ip-api.com
5	ipinfo.io

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\inf\wsearchidxpi\b75386f1303e64	fontWinnet.exe
File created	C:\Windows\Resources\Themes\Aero\de-DE\System.exe	fontWinnet.exe
File opened for modification	C:\Windows\Resources\Themes\Aero\de-DE\System.exe	fontWinnet.exe
File created	C:\Windows\Resources\Themes\Aero\de-DE\27d1bcfc3c54e0	fontWinnet.exe
File created	C:\Windows\inf\wsearchidxpi\taskhost.exe	fontWinnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	2820	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2860	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2860	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe
2344	fontWinnet.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	XClient.exe
Token: SeDebugPrivilege	2820	Build.exe
Token: SeDebugPrivilege	2344	fontWinnet.exe
Token: SeDebugPrivilege	1672	taskhost.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2632	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	30
PID 2936 wrote to memory of 2632	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	30
PID 2936 wrote to memory of 2632	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	30
PID 2936 wrote to memory of 2820	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	31
PID 2936 wrote to memory of 2820	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	31
PID 2936 wrote to memory of 2820	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	31
PID 2936 wrote to memory of 2820	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	31
PID 2936 wrote to memory of 2688	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	32
PID 2936 wrote to memory of 2688	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	32
PID 2936 wrote to memory of 2688	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	32
PID 2936 wrote to memory of 2688	2936	6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe	32
PID 2688 wrote to memory of 2548	2688	DCRatBuild.exe	33
PID 2688 wrote to memory of 2548	2688	DCRatBuild.exe	33
PID 2688 wrote to memory of 2548	2688	DCRatBuild.exe	33
PID 2688 wrote to memory of 2548	2688	DCRatBuild.exe	33
PID 2548 wrote to memory of 300	2548	WScript.exe	34
PID 2548 wrote to memory of 300	2548	WScript.exe	34
PID 2548 wrote to memory of 300	2548	WScript.exe	34
PID 2548 wrote to memory of 300	2548	WScript.exe	34
PID 300 wrote to memory of 2344	300	cmd.exe	36
PID 300 wrote to memory of 2344	300	cmd.exe	36
PID 300 wrote to memory of 2344	300	cmd.exe	36
PID 300 wrote to memory of 2344	300	cmd.exe	36
PID 2344 wrote to memory of 2984	2344	fontWinnet.exe	37
PID 2344 wrote to memory of 2984	2344	fontWinnet.exe	37
PID 2344 wrote to memory of 2984	2344	fontWinnet.exe	37
PID 2984 wrote to memory of 1424	2984	cmd.exe	39
PID 2984 wrote to memory of 1424	2984	cmd.exe	39
PID 2984 wrote to memory of 1424	2984	cmd.exe	39
PID 2984 wrote to memory of 2860	2984	cmd.exe	41
PID 2984 wrote to memory of 2860	2984	cmd.exe	41
PID 2984 wrote to memory of 2860	2984	cmd.exe	41
PID 2820 wrote to memory of 2252	2820	Build.exe	42
PID 2820 wrote to memory of 2252	2820	Build.exe	42
PID 2820 wrote to memory of 2252	2820	Build.exe	42
PID 2820 wrote to memory of 2252	2820	Build.exe	42
PID 2984 wrote to memory of 1672	2984	cmd.exe	43
PID 2984 wrote to memory of 1672	2984	cmd.exe	43
PID 2984 wrote to memory of 1672	2984	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe
"C:\Users\Admin\AppData\Local\Temp\6a4c87064969595078355dae42918fc19c3b71f422d6b5af9cee50a2af2d7b88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\Build.exe
  "C:\Users\Admin\AppData\Local\Temp\Build.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1092
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2252
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\WinnetCommonSvc\EF1rb20B7Zp52f5Q8odTU.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\WinnetCommonSvc\ckg6ORaGrHhdrhoaDEIfOHU33jMcFfgqQelkNCXcy5pLINkbo7vRcc.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:300
    - - C:\WinnetCommonSvc\fontWinnet.exe
        
        "C:\WinnetCommonSvc/fontWinnet.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2344
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\parYXJhJ7J.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1424
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2860
        
        C:\Windows\inf\wsearchidxpi\taskhost.exe
        
        "C:\Windows\inf\wsearchidxpi\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Build.exe

Filesize
250KB

MD5
b8f3934b55afbaa069717cd2e2eda6dd

SHA1
b33071c576f2637bd679002f01ca68e4df5112ec

SHA256
7cd58601d62de54c16bf279d2eb477a0e5b85f62cbe387268c1bec578db2a1e3

SHA512
2bab25ed6f190e56a96986400e5004956d44e3c9fe6e95e0b6540e503ad232ed3c08c85aaf3926a7bab3041fdbe64e363785c07fce9c011fc09abf2c39fde0c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
2.2MB

MD5
730239632db99d16b9f2656950408bcc

SHA1
ae877e836becf0b7727cf61c0277446c1c5ed381

SHA256
6dbcdb70833bb9ac5656887e6eae082ade4d197bcf6516c70e10ab196a23d292

SHA512
bd3b2973c54ee9754f19ef5eba73d9252de285c5d574611b01db0ea3f0c3c145686e319dc2a9f6b8aff94728eb1bfb8485a98152175cca5deed52b6318c16da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
64KB

MD5
31d745f5009eeda2da51b2d05d9711c5

SHA1
26c27b236bed8cb2046acddcc1c7d7b642b7c610

SHA256
37330d19e9479d225bf3934cf1b7bb233adc6bf0c8c876f181b814759d7c0b0f

SHA512
8319478d1ef266243e26592edbef9acbb07eb6de059043981e7f824424501691d41eef4736f6fe05e7ffc718ed0133489d22bd850c7a6773f7f50bf34207da4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\parYXJhJ7J.bat

Filesize
168B

MD5
433c4b3f139327b7b35bda12165be036

SHA1
cd0563413480ec87f06fa1a51f8d873a3716e712

SHA256
7dd5e18fd1b99f2037937f754b820440fb745ac119901850dc6c29a9877e1662

SHA512
6014102afc3c40890d2f3a9c1d761b2a01db5298945ed619a00b813ccf40e0eb60947714cf7c3864eb38719aa207e5d0c7b253276eae123f2f3917a5e7a865d7

Download Submit
C:\WinnetCommonSvc\EF1rb20B7Zp52f5Q8odTU.vbe

Filesize
247B

MD5
8fbc46f9794e1b89929cd710e53f0459

SHA1
15453a386f1c94b5ea4cd0ec41aa3c79c5dd2f54

SHA256
aaa6ca00879bea0f370824f57a72071aea49ae438ad2abb3eb4c9faddbab3d86

SHA512
b9fe28c4b771eae1f2261e4e17ec9e6d6055e17a5a2a5a32f8ecc7aaba9cf73f14e89ffafcc3455ed57cfa48fdde6d393630f585349f8ce4d2302543f323dc9b

Download Submit
C:\WinnetCommonSvc\ckg6ORaGrHhdrhoaDEIfOHU33jMcFfgqQelkNCXcy5pLINkbo7vRcc.bat

Filesize
89B

MD5
f2c017fa853e79d1fc9f0ef254fbd9b7

SHA1
911039790cbad8fd3d7ff7d5dd3ed0099adc4ed9

SHA256
8848856354f6c99d5821c08136a03c75597f43dbfe1f8475998db4b19e833b13

SHA512
ec1af3b307d7c7d30011ef7a9d0d1b7c53f15cdc7f028163fa40db3711e9d83271dc4a089160d9c9a6b4687ddd87b0cd6fd5bda2e375a080c8d0a6badc4885ca

Download Submit
C:\WinnetCommonSvc\fontWinnet.exe

Filesize
1.9MB

MD5
a5696185d5f9c88887e304e46944a366

SHA1
dd3daef6d70edcfbff6e58a123a25e212534941f

SHA256
3672ce6a54d5f04368c85ca8d46b2f0d67b548d05703bb14cf3492dc21fff8da

SHA512
9dadc5dfec936039b09aeed6c49a58cbe1162a9939283efa27d8660ea8aeeafc28d246ddf4270df93d89af15822d1f8b4aebc8d74ba040969753975013b3d579

Download Submit
memory/1672-74-0x0000000000B90000-0x0000000000D7C000-memory.dmp

Filesize
1.9MB

Download
memory/2344-37-0x0000000001310000-0x00000000014FC000-memory.dmp

Filesize
1.9MB

Download
memory/2344-47-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2344-49-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2344-39-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/2344-41-0x0000000000420000-0x000000000043C000-memory.dmp

Filesize
112KB

Download
memory/2344-43-0x00000000004D0000-0x00000000004E8000-memory.dmp

Filesize
96KB

Download
memory/2344-45-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/2632-20-0x00000000008E0000-0x00000000008F6000-memory.dmp

Filesize
88KB

Download
memory/2632-19-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2632-71-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2820-31-0x0000000000FF0000-0x0000000001034000-memory.dmp

Filesize
272KB

Download
memory/2936-0-0x000007FEF66B3000-0x000007FEF66B4000-memory.dmp

Filesize
4KB

Download
memory/2936-21-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2936-14-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2936-1-0x0000000000920000-0x0000000000AF8000-memory.dmp

Filesize
1.8MB

Download