dcrat | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
99s
max time network
111s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
14/04/2025, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa942bbb984e2be3a2e1d8414cc00cd7.exe
Size

984KB
MD5

fa942bbb984e2be3a2e1d8414cc00cd7
SHA1

822821106f149cbc674cccf5d8cc1aec612bb8f4
SHA256

07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4
SHA512

57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc
SSDEEP

12288:zzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:zzZvuGD2PvA5YxwmbZB6Uv

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	1844	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	1844	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	1844	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	1844	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	1844	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	1844	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	1844	schtasks.exe	83

Executes dropped EXE 8 IoCs

pid	Process
1728	backgroundTaskHost.exe
4612	unsecapp.exe
1136	smss.exe
2456	backgroundTaskHost.exe
3368	smss.exe
3572	OfficeClickToRun.exe
5116	sihost.exe
4524	smss.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Defender\\fr-FR\\smss.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\System32\\HoloSI.PCShell\\backgroundTaskHost.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\scm\\unsecapp.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\PerfLogs\\smss.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Documents and Settings\\OfficeClickToRun.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\Microsoft.Bluetooth.Service\\sihost.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\wbem\scm\RCXAF1E.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\Microsoft.Bluetooth.Service\RCXB52C.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\HoloSI.PCShell\backgroundTaskHost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\HoloSI.PCShell\backgroundTaskHost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\HoloSI.PCShell\eddb19405b7ce1	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\wbem\scm\29c1c3cc0f7685	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\Microsoft.Bluetooth.Service\66fc9ff0ee96c2	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\wbem\scm\unsecapp.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\Microsoft.Bluetooth.Service\sihost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\wbem\scm\unsecapp.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\Microsoft.Bluetooth.Service\sihost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\HoloSI.PCShell\RCXAD19.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\fr-FR\smss.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Program Files\Windows Defender\fr-FR\69ddcba757bf72	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\RCXB935.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\smss.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2787523927-1212474705-3964982594-1000_Classes\Local Settings	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2348	schtasks.exe
5032	schtasks.exe
5088	schtasks.exe
4348	schtasks.exe
3392	schtasks.exe
3984	schtasks.exe
2536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe
5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe
5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe
5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe
5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe
5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe
5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Token: SeDebugPrivilege	1728	backgroundTaskHost.exe
Token: SeDebugPrivilege	1136	smss.exe
Token: SeDebugPrivilege	3368	smss.exe
Token: SeDebugPrivilege	2456	backgroundTaskHost.exe
Token: SeDebugPrivilege	4612	unsecapp.exe
Token: SeDebugPrivilege	5116	sihost.exe
Token: SeDebugPrivilege	3572	OfficeClickToRun.exe
Token: SeDebugPrivilege	4524	smss.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1728	5072	cmd.exe	105
PID 5072 wrote to memory of 1728	5072	cmd.exe	105
PID 864 wrote to memory of 4612	864	cmd.exe	106
PID 864 wrote to memory of 4612	864	cmd.exe	106
PID 1876 wrote to memory of 1136	1876	cmd.exe	108
PID 1876 wrote to memory of 1136	1876	cmd.exe	108
PID 3400 wrote to memory of 2456	3400	cmd.exe	109
PID 3400 wrote to memory of 2456	3400	cmd.exe	109
PID 4528 wrote to memory of 3368	4528	cmd.exe	110
PID 4528 wrote to memory of 3368	4528	cmd.exe	110
PID 2452 wrote to memory of 3572	2452	cmd.exe	111
PID 2452 wrote to memory of 3572	2452	cmd.exe	111
PID 4184 wrote to memory of 5116	4184	cmd.exe	112
PID 4184 wrote to memory of 5116	4184	cmd.exe	112
PID 5096 wrote to memory of 1880	5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe	113
PID 5096 wrote to memory of 1880	5096	fa942bbb984e2be3a2e1d8414cc00cd7.exe	113
PID 1880 wrote to memory of 1188	1880	cmd.exe	115
PID 1880 wrote to memory of 1188	1880	cmd.exe	115
PID 1880 wrote to memory of 4524	1880	cmd.exe	116
PID 1880 wrote to memory of 4524	1880	cmd.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe
"C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KEzRcvni4f.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1188
- - C:\PerfLogs\smss.exe
    "C:\PerfLogs\smss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\System32\HoloSI.PCShell\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\HoloSI.PCShell\backgroundTaskHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\System32\HoloSI.PCShell\backgroundTaskHost.exe
  C:\Windows\System32\HoloSI.PCShell\backgroundTaskHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\scm\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\scm\unsecapp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\System32\wbem\scm\unsecapp.exe
  C:\Windows\System32\wbem\scm\unsecapp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\PerfLogs\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PerfLogs\smss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\PerfLogs\smss.exe
  C:\PerfLogs\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Documents and Settings\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\Microsoft.Bluetooth.Service\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Documents and Settings\OfficeClickToRun.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Documents and Settings\OfficeClickToRun.exe
  "C:\Documents and Settings\OfficeClickToRun.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\Microsoft.Bluetooth.Service\sihost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\System32\Microsoft.Bluetooth.Service\sihost.exe
  C:\Windows\System32\Microsoft.Bluetooth.Service\sihost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\WindowsRE\backgroundTaskHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Recovery\WindowsRE\backgroundTaskHost.exe
  C:\Recovery\WindowsRE\backgroundTaskHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\Windows Defender\fr-FR\smss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files\Windows Defender\fr-FR\smss.exe
  "C:\Program Files\Windows Defender\fr-FR\smss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\Temp\KEzRcvni4f.bat

Filesize
184B

MD5
2accbeb93c3337547c70005b0f6fded5

SHA1
00c660e869f8512e2157936fad7c344fe2806f17

SHA256
6d898fa6d54a9215aaa0e52c24877456d4d3f2c2ac8c7fa31afd90f4afb1cb46

SHA512
9c22f64ae4918d3b91004de357f79a1bb14100539c62d6372d665ea5da740ce42c1af5239bedb081e7438e70d573e391e2c6376fdebcc33751b141850423cda5

Download Submit
C:\Windows\System32\HoloSI.PCShell\backgroundTaskHost.exe

Filesize
984KB

MD5
fa942bbb984e2be3a2e1d8414cc00cd7

SHA1
822821106f149cbc674cccf5d8cc1aec612bb8f4

SHA256
07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4

SHA512
57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc

Download Submit
memory/4524-87-0x000000001D110000-0x000000001D122000-memory.dmp

Filesize
72KB

Download
memory/5096-10-0x00000000027B0000-0x00000000027C2000-memory.dmp

Filesize
72KB

Download
memory/5096-12-0x00000000027F0000-0x00000000027FC000-memory.dmp

Filesize
48KB

Download
memory/5096-6-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/5096-5-0x0000000002770000-0x0000000002780000-memory.dmp

Filesize
64KB

Download
memory/5096-0-0x00007FFB6A793000-0x00007FFB6A795000-memory.dmp

Filesize
8KB

Download
memory/5096-4-0x000000001B230000-0x000000001B280000-memory.dmp

Filesize
320KB

Download
memory/5096-3-0x0000000002750000-0x000000000276C000-memory.dmp

Filesize
112KB

Download
memory/5096-9-0x00000000027A0000-0x00000000027AC000-memory.dmp

Filesize
48KB

Download
memory/5096-11-0x000000001BFD0000-0x000000001C4F8000-memory.dmp

Filesize
5.2MB

Download
memory/5096-7-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/5096-78-0x00007FFB6A790000-0x00007FFB6B252000-memory.dmp

Filesize
10.8MB

Download
memory/5096-8-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/5096-2-0x00007FFB6A790000-0x00007FFB6B252000-memory.dmp

Filesize
10.8MB

Download
memory/5096-1-0x00000000003D0000-0x00000000004CC000-memory.dmp

Filesize
1008KB

Download