dcrat | 8a0ef9c526889a4acc99ea3adbc7a798fac03ea319579cb1d7a870cf0eb5e236

General

Target
11cca41734527d8b383fe392f47e78f2.exe
Size 1017KB
Sample251017-czpsdaes2c
SHA256 8a0ef9c526889a4acc99ea3adbc7a798fac03ea319579cb1d7a870cf0eb5e236
MD5 11cca41734527d8b383fe392f47e78f2
SHA1 c76141f21fa4163b406c5fa951685d1906310fe9
SHA512 6d0a5ae8a0c47dbeb1dc5b4696ccbd5d04f48d767d436b962ea849bd0e8d948c2913bdb9762d49efd0c5d5ffa4713723bfe130de940bcf442775726bb9d3664c
SSDEEP 24576:3PMsuw71LU5QE7AVO6UD7QkG3N97XBqD:3l1xA75AN9bB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5188	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5340	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5928	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	340	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	340	schtasks.exe	78

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3664-0-0x0000000000550000-0x0000000000656000-memory.dmp	dcrat
behavioral2/files/0x001c00000002b1fb-12.dat	dcrat

Executes dropped EXE 7 IoCs

pid	Process
4808	fontdrvhost.exe
5336	fontdrvhost.exe
4300	Registry.exe
4672	RuntimeBroker.exe
2868	spoolsv.exe
4260	explorer.exe
3572	fontdrvhost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe	11cca41734527d8b383fe392f47e78f2.exe
File created	C:\Program Files (x86)\Windows Sidebar\9e8d7a4ca61bd9	11cca41734527d8b383fe392f47e78f2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\CSC\StartMenuExperienceHost.exe	11cca41734527d8b383fe392f47e78f2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000_Classes\Local Settings	11cca41734527d8b383fe392f47e78f2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4916	schtasks.exe
3612	schtasks.exe
4924	schtasks.exe
3400	schtasks.exe
4668	schtasks.exe
5188	schtasks.exe
2232	schtasks.exe
5340	schtasks.exe
5928	schtasks.exe
2812	schtasks.exe
760	schtasks.exe
5012	schtasks.exe
3648	schtasks.exe
4632	schtasks.exe
1624	schtasks.exe
4980	schtasks.exe
4440	schtasks.exe
3348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3664	11cca41734527d8b383fe392f47e78f2.exe
3664	11cca41734527d8b383fe392f47e78f2.exe
3664	11cca41734527d8b383fe392f47e78f2.exe
4808	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	11cca41734527d8b383fe392f47e78f2.exe
Token: SeDebugPrivilege	4808	fontdrvhost.exe
Token: SeDebugPrivilege	5336	fontdrvhost.exe
Token: SeDebugPrivilege	4672	RuntimeBroker.exe
Token: SeDebugPrivilege	4300	Registry.exe
Token: SeDebugPrivilege	2868	spoolsv.exe
Token: SeDebugPrivilege	4260	explorer.exe
Token: SeDebugPrivilege	3572	fontdrvhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3328	3664	11cca41734527d8b383fe392f47e78f2.exe	97
PID 3664 wrote to memory of 3328	3664	11cca41734527d8b383fe392f47e78f2.exe	97
PID 3328 wrote to memory of 1592	3328	cmd.exe	99
PID 3328 wrote to memory of 1592	3328	cmd.exe	99
PID 3328 wrote to memory of 3572	3328	cmd.exe	112
PID 3328 wrote to memory of 3572	3328	cmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\11cca41734527d8b383fe392f47e78f2.exe
"C:\Users\Admin\AppData\Local\Temp\11cca41734527d8b383fe392f47e78f2.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vDgctAvnif.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1592
- - C:\Users\Admin\NetHood\fontdrvhost.exe
    "C:\Users\Admin\NetHood\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\b536a1a85897c3fd1a6388dfc3c5\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\b536a1a85897c3fd1a6388dfc3c5\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\b536a1a85897c3fd1a6388dfc3c5\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\NetHood\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\NetHood\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\ee7b48beb14adf7523fc40380cdb9c\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\ee7b48beb14adf7523fc40380cdb9c\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\ee7b48beb14adf7523fc40380cdb9c\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\ee7b48beb14adf7523fc40380cdb9c\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\ee7b48beb14adf7523fc40380cdb9c\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\ee7b48beb14adf7523fc40380cdb9c\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Users\Admin\NetHood\fontdrvhost.exe
"C:\Users\Admin\NetHood\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\ee7b48beb14adf7523fc40380cdb9c\fontdrvhost.exe
"C:\ee7b48beb14adf7523fc40380cdb9c\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5336

C:\ee7b48beb14adf7523fc40380cdb9c\Registry.exe
"C:\ee7b48beb14adf7523fc40380cdb9c\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
"C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\b536a1a85897c3fd1a6388dfc3c5\explorer.exe
"C:\b536a1a85897c3fd1a6388dfc3c5\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
MD5 SHA1 SHA512

Submit Download

vDgctAvnif.bat

Path C:\Users\Admin\AppData\Local\Temp\vDgctAvnif.bat
Size 203B
SHA256 a0a270e4d0950eb0a904e5fe659f2f20ab7e5c1285a0be3ed579b276ce44ee3d
MD5 04e3def30112c2da58c82f3df532b655
SHA1 02d15662c8cdab8db0f1663c898b325db8192d19
SHA512 bd5a1523feb57e79dc0738c56d1ad07cb803a6540274dd266971d11207cf1be87e91db6daa79cca0a2b078e5a74ab8672ea749801d9c378d94106fe51300caa4
MD5 SHA1 SHA512

Submit Download

Registry.exe

Path C:\ee7b48beb14adf7523fc40380cdb9c\Registry.exe
Size 1017KB
SHA256 8a0ef9c526889a4acc99ea3adbc7a798fac03ea319579cb1d7a870cf0eb5e236
MD5 11cca41734527d8b383fe392f47e78f2
SHA1 c76141f21fa4163b406c5fa951685d1906310fe9
SHA512 6d0a5ae8a0c47dbeb1dc5b4696ccbd5d04f48d767d436b962ea849bd0e8d948c2913bdb9762d49efd0c5d5ffa4713723bfe130de940bcf442775726bb9d3664c
SSDEEP 24576:3PMsuw71LU5QE7AVO6UD7QkG3N97XBqD:3l1xA75AN9bB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3664-0-0x0000000000550000-0x0000000000656000-memory.dmp

Download

memory/3664-1-0x0000000000F70000-0x0000000000F80000-memory.dmp

Download

memory/3664-2-0x00000000027B0000-0x00000000027C6000-memory.dmp

Download

memory/3664-3-0x0000000000FA0000-0x0000000000FAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads