dcrat | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

08/04/2025, 14:11

250408-rhjmcsvp15 10

22/03/2025, 06:18

250322-g2ywaay1fy 10

Analysis

max time kernel
92s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa942bbb984e2be3a2e1d8414cc00cd7.exe
Size

984KB
MD5

fa942bbb984e2be3a2e1d8414cc00cd7
SHA1

822821106f149cbc674cccf5d8cc1aec612bb8f4
SHA256

07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4
SHA512

57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc
SSDEEP

12288:zzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:zzZvuGD2PvA5YxwmbZB6Uv

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	624	schtasks.exe	88

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Executes dropped EXE 5 IoCs

pid	Process
552	lsass.exe
1696	RuntimeBroker.exe
1196	RuntimeBroker.exe
3012	SearchApp.exe
3068	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\PerfLogs\\lsass.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\ksproxy\\RuntimeBroker.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\es-ES\\SearchApp.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\ksproxy\RuntimeBroker.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\ksproxy\9e8d7a4ca61bd9	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\ksproxy\RCX7DBD.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\ksproxy\RuntimeBroker.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\es-ES\RCX81C7.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\es-ES\SearchApp.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\es-ES\SearchApp.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\es-ES\38384e6a620884	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2500	schtasks.exe
5116	schtasks.exe
3172	schtasks.exe
1300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1600	fa942bbb984e2be3a2e1d8414cc00cd7.exe
1600	fa942bbb984e2be3a2e1d8414cc00cd7.exe
1600	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Token: SeDebugPrivilege	552	lsass.exe
Token: SeDebugPrivilege	1696	RuntimeBroker.exe
Token: SeDebugPrivilege	3012	SearchApp.exe
Token: SeDebugPrivilege	1196	RuntimeBroker.exe
Token: SeDebugPrivilege	3068	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 552	1556	cmd.exe	101
PID 1556 wrote to memory of 552	1556	cmd.exe	101
PID 3048 wrote to memory of 1696	3048	cmd.exe	102
PID 3048 wrote to memory of 1696	3048	cmd.exe	102
PID 3440 wrote to memory of 1196	3440	cmd.exe	103
PID 3440 wrote to memory of 1196	3440	cmd.exe	103
PID 708 wrote to memory of 3012	708	cmd.exe	104
PID 708 wrote to memory of 3012	708	cmd.exe	104
PID 1600 wrote to memory of 4864	1600	fa942bbb984e2be3a2e1d8414cc00cd7.exe	109
PID 1600 wrote to memory of 4864	1600	fa942bbb984e2be3a2e1d8414cc00cd7.exe	109
PID 4864 wrote to memory of 3304	4864	cmd.exe	111
PID 4864 wrote to memory of 3304	4864	cmd.exe	111
PID 4864 wrote to memory of 3068	4864	cmd.exe	114
PID 4864 wrote to memory of 3068	4864	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe
"C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\S7kf05rXjE.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3304
- - C:\Recovery\WindowsRE\RuntimeBroker.exe
    "C:\Recovery\WindowsRE\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\PerfLogs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PerfLogs\lsass.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\PerfLogs\lsass.exe
  C:\PerfLogs\lsass.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\ksproxy\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\ksproxy\RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\ksproxy\RuntimeBroker.exe
  C:\Windows\System32\ksproxy\RuntimeBroker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Recovery\WindowsRE\RuntimeBroker.exe
  C:\Recovery\WindowsRE\RuntimeBroker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\es-ES\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\es-ES\SearchApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\es-ES\SearchApp.exe
  C:\Windows\es-ES\SearchApp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\lsass.exe

Filesize
984KB

MD5
fa942bbb984e2be3a2e1d8414cc00cd7

SHA1
822821106f149cbc674cccf5d8cc1aec612bb8f4

SHA256
07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4

SHA512
57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\S7kf05rXjE.bat

Filesize
203B

MD5
958eb0dfa58c4293c95b599656ec720c

SHA1
30579c40be45677ef9aec45bfa6af72c3b315cd0

SHA256
72cf41be2698a2829335c1998b6241da028f8beb4a7821c34ec5a008afaa9594

SHA512
7834a207152bfcdbd08c8dc448f1c6c7e7cd7f1dfa059e2a2a39875a47665bc1561d3b71cbb83d78942523815280ed65f77184e17584176efa6d5a595fc9882b

Download Submit
memory/1600-9-0x0000000002AA0000-0x0000000002AAC000-memory.dmp

Filesize
48KB

Download
memory/1600-10-0x0000000002AB0000-0x0000000002AC2000-memory.dmp

Filesize
72KB

Download
memory/1600-3-0x0000000000FF0000-0x000000000100C000-memory.dmp

Filesize
112KB

Download
memory/1600-7-0x0000000002A80000-0x0000000002A88000-memory.dmp

Filesize
32KB

Download
memory/1600-6-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/1600-0-0x00007FFE3CB93000-0x00007FFE3CB95000-memory.dmp

Filesize
8KB

Download
memory/1600-8-0x0000000002A90000-0x0000000002AA0000-memory.dmp

Filesize
64KB

Download
memory/1600-5-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/1600-12-0x0000000002AE0000-0x0000000002AEC000-memory.dmp

Filesize
48KB

Download
memory/1600-11-0x000000001C410000-0x000000001C938000-memory.dmp

Filesize
5.2MB

Download
memory/1600-4-0x000000001B3E0000-0x000000001B430000-memory.dmp

Filesize
320KB

Download
memory/1600-2-0x00007FFE3CB90000-0x00007FFE3D651000-memory.dmp

Filesize
10.8MB

Download
memory/1600-54-0x00007FFE3CB90000-0x00007FFE3D651000-memory.dmp

Filesize
10.8MB

Download
memory/1600-1-0x0000000000740000-0x000000000083C000-memory.dmp

Filesize
1008KB

Download