dcrat | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

max time kernel
104s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2025, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa942bbb984e2be3a2e1d8414cc00cd7.exe
Size 984KB
Sample250425-ryf66svsby
SHA256 07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4
MD5 fa942bbb984e2be3a2e1d8414cc00cd7
SHA1 822821106f149cbc674cccf5d8cc1aec612bb8f4
SHA512 57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc
SSDEEP 12288:zzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:zzZvuGD2PvA5YxwmbZB6Uv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	4064	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	4064	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	4064	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4064	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	4064	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	4064	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	4064	schtasks.exe	89

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000\Control Panel\International\Geo\Nation	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Executes dropped EXE 8 IoCs

pid	Process
2996	Idle.exe
964	lsass.exe
1148	fontdrvhost.exe
2636	backgroundTaskHost.exe
2440	unsecapp.exe
396	csrss.exe
2072	Registry.exe
3292	backgroundTaskHost.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\ProgramData\\Documents\\lsass.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\LiveKernelReports\\backgroundTaskHost.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\mscorier\\fontdrvhost.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\PrintManagementProvider\\unsecapp.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\Registry.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\bb4d04c510759cc0f3d569e9\\csrss.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\wbem\PrintManagementProvider\RCX6621.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\wbem\PrintManagementProvider\unsecapp.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\mscorier\fontdrvhost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\mscorier\5b884080fd4f94	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\wbem\PrintManagementProvider\unsecapp.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\wbem\PrintManagementProvider\29c1c3cc0f7685	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\mscorier\RCX641D.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\mscorier\fontdrvhost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\es-ES\Registry.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\ee2ad38f3d4382	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\RCX6826.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\Registry.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\LiveKernelReports\backgroundTaskHost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\LiveKernelReports\eddb19405b7ce1	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\LiveKernelReports\RCX6218.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\LiveKernelReports\backgroundTaskHost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4128	schtasks.exe
4812	schtasks.exe
1448	schtasks.exe
1928	schtasks.exe
3792	schtasks.exe
4768	schtasks.exe
1884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Token: SeDebugPrivilege	2996	Idle.exe
Token: SeDebugPrivilege	964	lsass.exe
Token: SeDebugPrivilege	396	csrss.exe
Token: SeDebugPrivilege	1148	fontdrvhost.exe
Token: SeDebugPrivilege	2440	unsecapp.exe
Token: SeDebugPrivilege	2636	backgroundTaskHost.exe
Token: SeDebugPrivilege	2072	Registry.exe
Token: SeDebugPrivilege	3292	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2996	2516	cmd.exe	107
PID 2516 wrote to memory of 2996	2516	cmd.exe	107
PID 4920 wrote to memory of 964	4920	cmd.exe	112
PID 4920 wrote to memory of 964	4920	cmd.exe	112
PID 4364 wrote to memory of 2636	4364	cmd.exe	114
PID 4364 wrote to memory of 2636	4364	cmd.exe	114
PID 2652 wrote to memory of 1148	2652	cmd.exe	113
PID 2652 wrote to memory of 1148	2652	cmd.exe	113
PID 4036 wrote to memory of 2440	4036	cmd.exe	115
PID 4036 wrote to memory of 2440	4036	cmd.exe	115
PID 4332 wrote to memory of 396	4332	cmd.exe	116
PID 4332 wrote to memory of 396	4332	cmd.exe	116
PID 4716 wrote to memory of 2072	4716	cmd.exe	117
PID 4716 wrote to memory of 2072	4716	cmd.exe	117
PID 1504 wrote to memory of 3292	1504	fa942bbb984e2be3a2e1d8414cc00cd7.exe	124
PID 1504 wrote to memory of 3292	1504	fa942bbb984e2be3a2e1d8414cc00cd7.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe
"C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\LiveKernelReports\backgroundTaskHost.exe
  "C:\Windows\LiveKernelReports\backgroundTaskHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\ProgramData\Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\Documents\lsass.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\ProgramData\Documents\lsass.exe
  C:\ProgramData\Documents\lsass.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\WindowsRE\Idle.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Recovery\WindowsRE\Idle.exe
  C:\Recovery\WindowsRE\Idle.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\LiveKernelReports\backgroundTaskHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\LiveKernelReports\backgroundTaskHost.exe
  C:\Windows\LiveKernelReports\backgroundTaskHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\mscorier\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\mscorier\fontdrvhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\System32\mscorier\fontdrvhost.exe
  C:\Windows\System32\mscorier\fontdrvhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\PrintManagementProvider\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\PrintManagementProvider\unsecapp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\System32\wbem\PrintManagementProvider\unsecapp.exe
  C:\Windows\System32\wbem\PrintManagementProvider\unsecapp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Windows Media Player\es-ES\Registry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Windows Media Player\es-ES\Registry.exe
  "C:\Program Files (x86)\Windows Media Player\es-ES\Registry.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\bb4d04c510759cc0f3d569e9\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\bb4d04c510759cc0f3d569e9\csrss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\bb4d04c510759cc0f3d569e9\csrss.exe
  C:\bb4d04c510759cc0f3d569e9\csrss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Idle.exe

Path C:\Recovery\WindowsRE\Idle.exe
Size 984KB
SHA256 07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4
MD5 fa942bbb984e2be3a2e1d8414cc00cd7
SHA1 822821106f149cbc674cccf5d8cc1aec612bb8f4
SHA512 57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc
SSDEEP 12288:zzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:zzZvuGD2PvA5YxwmbZB6Uv
MD5 SHA1 SHA512 SSDEEP

Submit Download

backgroundTaskHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\backgroundTaskHost.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

memory/1504-11-0x000000001C0A0000-0x000000001C5C8000-memory.dmp

Download

memory/1504-7-0x0000000002790000-0x0000000002798000-memory.dmp

Download

memory/1504-8-0x000000001B280000-0x000000001B290000-memory.dmp

Download

memory/1504-10-0x000000001B2A0000-0x000000001B2B2000-memory.dmp

Download

memory/1504-9-0x000000001B290000-0x000000001B29C000-memory.dmp

Download

memory/1504-12-0x000000001B320000-0x000000001B32C000-memory.dmp

Download

memory/1504-1-0x0000000000540000-0x000000000063C000-memory.dmp

Download

memory/1504-5-0x0000000000EF0000-0x0000000000F00000-memory.dmp

Download

memory/1504-2-0x00007FFE93470000-0x00007FFE93F31000-memory.dmp

Download

memory/1504-6-0x0000000002780000-0x0000000002790000-memory.dmp

Download

memory/1504-4-0x000000001B2D0000-0x000000001B320000-memory.dmp

Download

memory/1504-3-0x0000000002750000-0x000000000276C000-memory.dmp

Download

memory/1504-74-0x00007FFE93470000-0x00007FFE93F31000-memory.dmp

Download

memory/1504-0-0x00007FFE93473000-0x00007FFE93475000-memory.dmp

Download