dcrat | 7d406ea4f3c94f86228662495df35517c89df991b672eb804d5ec796fa0a2a63

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2025, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7444d4b374e22e9dcbb54701baed11ac.exe
Size 2.3MB
Sample250901-e74mlswthy
SHA256 7d406ea4f3c94f86228662495df35517c89df991b672eb804d5ec796fa0a2a63
MD5 7444d4b374e22e9dcbb54701baed11ac
SHA1 fc06d01744009206d6d63053e758b595f86a6795
SHA512 778a9fe214d1e9835c1ea041b577c49219d712fa602c3944f8a9ba7a19bf60e72ecdf41157fd99bb5ed5f6e2e46d4173b06278e9ded59fa368dd12142ab6c3a2
SSDEEP 49152:va3mif54OP5zI99Un90Fgv7op6gqUuQLdMBJ6r:v5if5nRzIJ6v0p6zYAJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5212	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6064	1992	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	1992	schtasks.exe	84

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1708-0-0x0000000000AA0000-0x0000000000CFA000-memory.dmp	dcrat
behavioral1/files/0x0007000000024275-20.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation	7444d4b374e22e9dcbb54701baed11ac.exe

Executes dropped EXE 1 IoCs

pid	Process
2336	csrss.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ipinfo.io
19	ipinfo.io

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/1708-8-0x000000001BEF0000-0x000000001BEFC000-memory.dmp	SmartAssembly
behavioral1/memory/1708-9-0x000000001BF00000-0x000000001BF0C000-memory.dmp	SmartAssembly

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1364	schtasks.exe
3940	schtasks.exe
1484	schtasks.exe
1928	schtasks.exe
2700	schtasks.exe
3040	schtasks.exe
2932	schtasks.exe
4820	schtasks.exe
1756	schtasks.exe
848	schtasks.exe
6064	schtasks.exe
3268	schtasks.exe
4572	schtasks.exe
3972	schtasks.exe
5212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1708	7444d4b374e22e9dcbb54701baed11ac.exe
1708	7444d4b374e22e9dcbb54701baed11ac.exe
1708	7444d4b374e22e9dcbb54701baed11ac.exe
1708	7444d4b374e22e9dcbb54701baed11ac.exe
1708	7444d4b374e22e9dcbb54701baed11ac.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe
2336	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	7444d4b374e22e9dcbb54701baed11ac.exe
Token: SeDebugPrivilege	2336	csrss.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2336	1708	7444d4b374e22e9dcbb54701baed11ac.exe	100
PID 1708 wrote to memory of 2336	1708	7444d4b374e22e9dcbb54701baed11ac.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7444d4b374e22e9dcbb54701baed11ac.exe
"C:\Users\Admin\AppData\Local\Temp\7444d4b374e22e9dcbb54701baed11ac.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\86b12d10dea452d1b6afc48c67870d\csrss.exe
  "C:\86b12d10dea452d1b6afc48c67870d\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\86b12d10dea452d1b6afc48c67870d\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\86b12d10dea452d1b6afc48c67870d\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\86b12d10dea452d1b6afc48c67870d\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\076010aa937857787dd079a1044a748b\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\076010aa937857787dd079a1044a748b\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\076010aa937857787dd079a1044a748b\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\076010aa937857787dd079a1044a748b\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\076010aa937857787dd079a1044a748b\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\076010aa937857787dd079a1044a748b\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\86b12d10dea452d1b6afc48c67870d\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\86b12d10dea452d1b6afc48c67870d\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\86b12d10dea452d1b6afc48c67870d\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\86b12d10dea452d1b6afc48c67870d\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\86b12d10dea452d1b6afc48c67870d\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\86b12d10dea452d1b6afc48c67870d\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\86b12d10dea452d1b6afc48c67870d\csrss.exe
Size 2.3MB
SHA256 7d406ea4f3c94f86228662495df35517c89df991b672eb804d5ec796fa0a2a63
MD5 7444d4b374e22e9dcbb54701baed11ac
SHA1 fc06d01744009206d6d63053e758b595f86a6795
SHA512 778a9fe214d1e9835c1ea041b577c49219d712fa602c3944f8a9ba7a19bf60e72ecdf41157fd99bb5ed5f6e2e46d4173b06278e9ded59fa368dd12142ab6c3a2
SSDEEP 49152:va3mif54OP5zI99Un90Fgv7op6gqUuQLdMBJ6r:v5if5nRzIJ6v0p6zYAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1708-6-0x000000001BE50000-0x000000001BEA6000-memory.dmp

Download

memory/1708-2-0x0000000003030000-0x000000000303E000-memory.dmp

Download

memory/1708-3-0x0000000003040000-0x000000000304E000-memory.dmp

Download

memory/1708-4-0x000000001BE30000-0x000000001BE4C000-memory.dmp

Download

memory/1708-5-0x000000001BEA0000-0x000000001BEF0000-memory.dmp

Download

memory/1708-0-0x0000000000AA0000-0x0000000000CFA000-memory.dmp

Download

memory/1708-7-0x0000000003050000-0x0000000003058000-memory.dmp

Download

memory/1708-8-0x000000001BEF0000-0x000000001BEFC000-memory.dmp

Download

memory/1708-9-0x000000001BF00000-0x000000001BF0C000-memory.dmp

Download

memory/1708-10-0x000000001C280000-0x000000001C28E000-memory.dmp

Download

memory/1708-11-0x000000001C110000-0x000000001C11C000-memory.dmp

Download

memory/1708-1-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Download

memory/2336-33-0x000000001E700000-0x000000001E8C2000-memory.dmp

Download