dcrat | 7d406ea4f3c94f86228662495df35517c89df991b672eb804d5ec796fa0a2a63

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2025, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7444d4b374e22e9dcbb54701baed11ac.exe
Size 2.3MB
Sample250901-e74mlswthy
SHA256 7d406ea4f3c94f86228662495df35517c89df991b672eb804d5ec796fa0a2a63
MD5 7444d4b374e22e9dcbb54701baed11ac
SHA1 fc06d01744009206d6d63053e758b595f86a6795
SHA512 778a9fe214d1e9835c1ea041b577c49219d712fa602c3944f8a9ba7a19bf60e72ecdf41157fd99bb5ed5f6e2e46d4173b06278e9ded59fa368dd12142ab6c3a2
SSDEEP 49152:va3mif54OP5zI99Un90Fgv7op6gqUuQLdMBJ6r:v5if5nRzIJ6v0p6zYAJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5912	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5972	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	1932	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	1932	schtasks.exe	79

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/5808-0-0x0000000000360000-0x00000000005BA000-memory.dmp	dcrat
behavioral2/files/0x001900000002b171-20.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
6044	sysmon.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
4	ipinfo.io

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5808-8-0x00000000028A0000-0x00000000028AC000-memory.dmp	SmartAssembly
behavioral2/memory/5808-9-0x00000000028B0000-0x00000000028BC000-memory.dmp	SmartAssembly

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\spoolsv.exe	7444d4b374e22e9dcbb54701baed11ac.exe
File created	C:\Program Files (x86)\Google\Update\f3b6ecef712a24	7444d4b374e22e9dcbb54701baed11ac.exe
File created	C:\Program Files\ModifiableWindowsApps\sysmon.exe	7444d4b374e22e9dcbb54701baed11ac.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\es-ES\7444d4b374e22e9dcbb54701baed11ac.exe	7444d4b374e22e9dcbb54701baed11ac.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\es-ES\000933a020c341	7444d4b374e22e9dcbb54701baed11ac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000_Classes\Local Settings	7444d4b374e22e9dcbb54701baed11ac.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3156	schtasks.exe
3732	schtasks.exe
4900	schtasks.exe
3404	schtasks.exe
5116	schtasks.exe
3408	schtasks.exe
1572	schtasks.exe
2264	schtasks.exe
5972	schtasks.exe
4780	schtasks.exe
4860	schtasks.exe
4876	schtasks.exe
4904	schtasks.exe
432	schtasks.exe
3348	schtasks.exe
3844	schtasks.exe
672	schtasks.exe
4808	schtasks.exe
2332	schtasks.exe
4928	schtasks.exe
5912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
5808	7444d4b374e22e9dcbb54701baed11ac.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe
6044	sysmon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6044	sysmon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5808	7444d4b374e22e9dcbb54701baed11ac.exe
Token: SeDebugPrivilege	6044	sysmon.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 3576	5808	7444d4b374e22e9dcbb54701baed11ac.exe	101
PID 5808 wrote to memory of 3576	5808	7444d4b374e22e9dcbb54701baed11ac.exe	101
PID 3576 wrote to memory of 3796	3576	cmd.exe	103
PID 3576 wrote to memory of 3796	3576	cmd.exe	103
PID 3576 wrote to memory of 6044	3576	cmd.exe	104
PID 3576 wrote to memory of 6044	3576	cmd.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7444d4b374e22e9dcbb54701baed11ac.exe
"C:\Users\Admin\AppData\Local\Temp\7444d4b374e22e9dcbb54701baed11ac.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sMbwXZ6WBF.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3796
- - C:\Users\Default\Music\sysmon.exe
    "C:\Users\Default\Music\sysmon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:6044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\a2a3d436d564c99afcc5d7\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\a2a3d436d564c99afcc5d7\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\a2a3d436d564c99afcc5d7\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\c599bf4aca4a3f8e50d49e699299\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\c599bf4aca4a3f8e50d49e699299\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\c599bf4aca4a3f8e50d49e699299\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7444d4b374e22e9dcbb54701baed11ac7" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\es-ES\7444d4b374e22e9dcbb54701baed11ac.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7444d4b374e22e9dcbb54701baed11ac" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\es-ES\7444d4b374e22e9dcbb54701baed11ac.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7444d4b374e22e9dcbb54701baed11ac7" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\es-ES\7444d4b374e22e9dcbb54701baed11ac.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Update\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Update\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Music\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Music\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Music\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\Music\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Music\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\c599bf4aca4a3f8e50d49e699299\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\c599bf4aca4a3f8e50d49e699299\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\c599bf4aca4a3f8e50d49e699299\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sMbwXZ6WBF.bat

Path C:\Users\Admin\AppData\Local\Temp\sMbwXZ6WBF.bat
Size 198B
SHA256 6a83cc7c0b0cebb4c2facd9e7c463c156fddb60724d54b0bb04674a24dd70437
MD5 13ed995253848ebf90ba444b4070ffe1
SHA1 a13ca12c26ce0798b742a777fb6fe48c42248285
SHA512 af0cbb0b843aa9f200b3fdd1fe94c424139c3c3184570e27df46bd4fd41876701732de5bf820a78c40e38ba106a6f121816ab124c6e1d68d81ac59add0335be1
MD5 SHA1 SHA512

Submit Download

spoolsv.exe

Path C:\Users\Admin\Music\spoolsv.exe
Size 2.3MB
SHA256 7d406ea4f3c94f86228662495df35517c89df991b672eb804d5ec796fa0a2a63
MD5 7444d4b374e22e9dcbb54701baed11ac
SHA1 fc06d01744009206d6d63053e758b595f86a6795
SHA512 778a9fe214d1e9835c1ea041b577c49219d712fa602c3944f8a9ba7a19bf60e72ecdf41157fd99bb5ed5f6e2e46d4173b06278e9ded59fa368dd12142ab6c3a2
SSDEEP 49152:va3mif54OP5zI99Un90Fgv7op6gqUuQLdMBJ6r:v5if5nRzIJ6v0p6zYAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5808-10-0x000000001B2F0000-0x000000001B2FE000-memory.dmp

Download

memory/5808-11-0x000000001B300000-0x000000001B30C000-memory.dmp

Download

memory/5808-4-0x0000000002870000-0x000000000288C000-memory.dmp

Download

memory/5808-5-0x000000001B930000-0x000000001B980000-memory.dmp

Download

memory/5808-6-0x000000001B2A0000-0x000000001B2F6000-memory.dmp

Download

memory/5808-7-0x0000000002890000-0x0000000002898000-memory.dmp

Download

memory/5808-8-0x00000000028A0000-0x00000000028AC000-memory.dmp

Download

memory/5808-9-0x00000000028B0000-0x00000000028BC000-memory.dmp

Download

memory/5808-0-0x0000000000360000-0x00000000005BA000-memory.dmp

Download

memory/5808-3-0x0000000002860000-0x000000000286E000-memory.dmp

Download

memory/5808-2-0x0000000000DF0000-0x0000000000DFE000-memory.dmp

Download

memory/5808-1-0x000000001B320000-0x000000001B330000-memory.dmp

Download

memory/6044-35-0x000000001CFE0000-0x000000001D1A2000-memory.dmp

Download

memory/6044-37-0x000000001CA10000-0x000000001CA19000-memory.dmp

Download

memory/6044-38-0x000000001CAE0000-0x000000001CAED000-memory.dmp

Download

memory/6044-36-0x000000001CA70000-0x000000001CAB6000-memory.dmp

Download

memory/6044-40-0x000000001CF10000-0x000000001CF1B000-memory.dmp

Download

memory/6044-39-0x000000001CAF0000-0x000000001CB0E000-memory.dmp

Download