dcrat | 8a0ef9c526889a4acc99ea3adbc7a798fac03ea319579cb1d7a870cf0eb5e236

General

Target
11cca41734527d8b383fe392f47e78f2.exe
Size 1017KB
Sample251017-czpsdaes2c
SHA256 8a0ef9c526889a4acc99ea3adbc7a798fac03ea319579cb1d7a870cf0eb5e236
MD5 11cca41734527d8b383fe392f47e78f2
SHA1 c76141f21fa4163b406c5fa951685d1906310fe9
SHA512 6d0a5ae8a0c47dbeb1dc5b4696ccbd5d04f48d767d436b962ea849bd0e8d948c2913bdb9762d49efd0c5d5ffa4713723bfe130de940bcf442775726bb9d3664c
SSDEEP 24576:3PMsuw71LU5QE7AVO6UD7QkG3N97XBqD:3l1xA75AN9bB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5764	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6112	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4572	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	4572	schtasks.exe	84

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/4352-0-0x0000000000560000-0x0000000000666000-memory.dmp	dcrat
behavioral1/files/0x000700000002420d-12.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000\Control Panel\International\Geo\Nation	11cca41734527d8b383fe392f47e78f2.exe

Executes dropped EXE 7 IoCs

pid	Process
988	RuntimeBroker.exe
4176	backgroundTaskHost.exe
4700	RuntimeBroker.exe
508	TextInputHost.exe
1784	services.exe
1064	TextInputHost.exe
1256	services.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\TextInputHost.exe	11cca41734527d8b383fe392f47e78f2.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\TextInputHost.exe	11cca41734527d8b383fe392f47e78f2.exe
File created	C:\Program Files\Windows Multimedia Platform\22eafd247d37c3	11cca41734527d8b383fe392f47e78f2.exe
File created	C:\Program Files (x86)\Windows Mail\TextInputHost.exe	11cca41734527d8b383fe392f47e78f2.exe
File created	C:\Program Files (x86)\Windows Mail\22eafd247d37c3	11cca41734527d8b383fe392f47e78f2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Panther\actionqueue\9e8d7a4ca61bd9	11cca41734527d8b383fe392f47e78f2.exe
File created	C:\Windows\Panther\actionqueue\RuntimeBroker.exe	11cca41734527d8b383fe392f47e78f2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000_Classes\Local Settings	11cca41734527d8b383fe392f47e78f2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4228	schtasks.exe
5764	schtasks.exe
2472	schtasks.exe
4788	schtasks.exe
1176	schtasks.exe
6112	schtasks.exe
4308	schtasks.exe
800	schtasks.exe
4980	schtasks.exe
4536	schtasks.exe
4932	schtasks.exe
32	schtasks.exe
2624	schtasks.exe
3328	schtasks.exe
1312	schtasks.exe
4804	schtasks.exe
4324	schtasks.exe
3684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4352	11cca41734527d8b383fe392f47e78f2.exe
4352	11cca41734527d8b383fe392f47e78f2.exe
4352	11cca41734527d8b383fe392f47e78f2.exe
4352	11cca41734527d8b383fe392f47e78f2.exe
4352	11cca41734527d8b383fe392f47e78f2.exe
4352	11cca41734527d8b383fe392f47e78f2.exe
4352	11cca41734527d8b383fe392f47e78f2.exe
988	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	11cca41734527d8b383fe392f47e78f2.exe
Token: SeDebugPrivilege	988	RuntimeBroker.exe
Token: SeDebugPrivilege	4176	backgroundTaskHost.exe
Token: SeDebugPrivilege	4700	RuntimeBroker.exe
Token: SeDebugPrivilege	1784	services.exe
Token: SeDebugPrivilege	508	TextInputHost.exe
Token: SeDebugPrivilege	1064	TextInputHost.exe
Token: SeDebugPrivilege	1256	services.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4164	4352	11cca41734527d8b383fe392f47e78f2.exe	104
PID 4352 wrote to memory of 4164	4352	11cca41734527d8b383fe392f47e78f2.exe	104
PID 4164 wrote to memory of 900	4164	cmd.exe	106
PID 4164 wrote to memory of 900	4164	cmd.exe	106
PID 4164 wrote to memory of 1256	4164	cmd.exe	119
PID 4164 wrote to memory of 1256	4164	cmd.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\11cca41734527d8b383fe392f47e78f2.exe
"C:\Users\Admin\AppData\Local\Temp\11cca41734527d8b383fe392f47e78f2.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CqaKHWd6Ky.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:900
- - C:\Users\Default User\services.exe
    "C:\Users\Default User\services.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Panther\actionqueue\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Panther\actionqueue\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\Panther\actionqueue\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Recovery\WindowsRE\RuntimeBroker.exe
"C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Users\Admin\AppData\Roaming\Microsoft\backgroundTaskHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\backgroundTaskHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\Panther\actionqueue\RuntimeBroker.exe
"C:\Windows\Panther\actionqueue\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Program Files (x86)\Windows Mail\TextInputHost.exe
"C:\Program Files (x86)\Windows Mail\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:508

C:\Users\Default User\services.exe
"C:\Users\Default User\services.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Program Files\Windows Multimedia Platform\TextInputHost.exe
"C:\Program Files\Windows Multimedia Platform\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TextInputHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

CqaKHWd6Ky.bat

Path C:\Users\Admin\AppData\Local\Temp\CqaKHWd6Ky.bat
Size 199B
SHA256 5be636c6e7d82a0dbb4b0a0d1a356d87fe9a8fbe3221ea4f5bdae910525e4a88
MD5 47ee787e12d5a7c081a1bc5d6c2d52d9
SHA1 e1f2639623359e45fc1e0014446b5c64c27f9be9
SHA512 281c2b98f220da4a5d8cb7a569d425a4ed9d87d89f21c481220f09130fbaf02480ba2ad430b46ba8d8beab7e50dcca7e14f94ca01145ae4c76f506c7d9f11ed7
MD5 SHA1 SHA512

Submit Download

RuntimeBroker.exe

Path C:\Windows\Panther\actionqueue\RuntimeBroker.exe
Size 1017KB
SHA256 8a0ef9c526889a4acc99ea3adbc7a798fac03ea319579cb1d7a870cf0eb5e236
MD5 11cca41734527d8b383fe392f47e78f2
SHA1 c76141f21fa4163b406c5fa951685d1906310fe9
SHA512 6d0a5ae8a0c47dbeb1dc5b4696ccbd5d04f48d767d436b962ea849bd0e8d948c2913bdb9762d49efd0c5d5ffa4713723bfe130de940bcf442775726bb9d3664c
SSDEEP 24576:3PMsuw71LU5QE7AVO6UD7QkG3N97XBqD:3l1xA75AN9bB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4352-0-0x0000000000560000-0x0000000000666000-memory.dmp

Download

memory/4352-1-0x000000001B240000-0x000000001B250000-memory.dmp

Download

memory/4352-2-0x000000001B890000-0x000000001B8A6000-memory.dmp

Download

memory/4352-3-0x0000000000EA0000-0x0000000000EAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads