dcrat | c0e0b2e9e50a2e015bd89693b4375624a3ec3b1bcf3f6a750c9de79720cae817

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18149EAD55CB415131241B4ED5559F49.exe
Size 996KB
Sample260828-vcfv3azzht
SHA256 c0e0b2e9e50a2e015bd89693b4375624a3ec3b1bcf3f6a750c9de79720cae817
MD5 18149ead55cb415131241b4ed5559f49
SHA1 fe8af3a88ef5559529b4296077defc4738a8344a
SHA512 4df790144d463096b96be059b0594f26a692e113d6637dd5e94af9ae04ff1da9d017da70896816d93817ea623274805ae24ce8ac39ee5c5cd20f73f9a6421577
SSDEEP 12288:hu1L1DSn+sbkYVJx/xFZqmwnjDBip/rqCWi2rqXKg7p5cyi7D9t0:hwgn+sbkwRxbqmI8p/lkWayO7D92
TLSH
T1D0252A017E44CE11F0195233C2EF454847B09A5566F6E72B7DBA376E2A623A73C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3188-1-0x0000000000C60000-0x0000000000D60000-memory.dmp	dcrat
behavioral2/files/0x000f00000001c4df-24.dat	dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6012	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5124	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	2708	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2708	schtasks.exe	88

Executes dropped EXE 7 IoCs

pid	Process
1008	dllhost.exe
4612	RuntimeBroker.exe
440	csrss.exe
3736	lsass.exe
1252	OfficeClickToRun.exe
3932	Idle.exe
2420	Idle.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\csrss.exe	18149EAD55CB415131241B4ED5559F49.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\886983d96e3d3e	18149EAD55CB415131241B4ED5559F49.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2852	schtasks.exe
1980	schtasks.exe
3008	schtasks.exe
4144	schtasks.exe
3360	schtasks.exe
5056	schtasks.exe
1180	schtasks.exe
4140	schtasks.exe
4880	schtasks.exe
1068	schtasks.exe
4308	schtasks.exe
6012	schtasks.exe
2140	schtasks.exe
2760	schtasks.exe
3984	schtasks.exe
4584	schtasks.exe
1712	schtasks.exe
3284	schtasks.exe
5124	schtasks.exe
4856	schtasks.exe
304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe
3188	18149EAD55CB415131241B4ED5559F49.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	18149EAD55CB415131241B4ED5559F49.exe
Token: SeDebugPrivilege	4612	RuntimeBroker.exe
Token: SeDebugPrivilege	1008	dllhost.exe
Token: SeDebugPrivilege	440	csrss.exe
Token: SeDebugPrivilege	1252	OfficeClickToRun.exe
Token: SeDebugPrivilege	3736	lsass.exe
Token: SeDebugPrivilege	3932	Idle.exe
Token: SeDebugPrivilege	2420	Idle.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 2420	3188	18149EAD55CB415131241B4ED5559F49.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\18149EAD55CB415131241B4ED5559F49.exe
"C:\Users\Admin\AppData\Local\Temp\18149EAD55CB415131241B4ED5559F49.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Recovery\WindowsRE\Idle.exe
  "C:\Recovery\WindowsRE\Idle.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\plugins\codec\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\codec\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\plugins\codec\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Recovery\WindowsRE\dllhost.exe
"C:\Recovery\WindowsRE\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Users\Default User\RuntimeBroker.exe
"C:\Users\Default User\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Program Files\VideoLAN\VLC\plugins\codec\csrss.exe
"C:\Program Files\VideoLAN\VLC\plugins\codec\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Recovery\WindowsRE\lsass.exe
"C:\Recovery\WindowsRE\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Recovery\WindowsRE\OfficeClickToRun.exe
"C:\Recovery\WindowsRE\OfficeClickToRun.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Recovery\WindowsRE\Idle.exe
"C:\Recovery\WindowsRE\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe

Path C:\Recovery\WindowsRE\dllhost.exe
Size 996KB
SHA256 c0e0b2e9e50a2e015bd89693b4375624a3ec3b1bcf3f6a750c9de79720cae817
MD5 18149ead55cb415131241b4ed5559f49
SHA1 fe8af3a88ef5559529b4296077defc4738a8344a
SHA512 4df790144d463096b96be059b0594f26a692e113d6637dd5e94af9ae04ff1da9d017da70896816d93817ea623274805ae24ce8ac39ee5c5cd20f73f9a6421577
SSDEEP 12288:hu1L1DSn+sbkYVJx/xFZqmwnjDBip/rqCWi2rqXKg7p5cyi7D9t0:hwgn+sbkwRxbqmI8p/lkWayO7D92
TLSH
T1D0252A017E44CE11F0195233C2EF454847B09A5566F6E72B7DBA376E2A623A73C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3188-9-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-12-0x0000000002F50000-0x0000000002F5E000-memory.dmp

Download

memory/3188-3-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-5-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-4-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-6-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-7-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-0-0x00007FFDAF6AF000-0x00007FFDAF6B0000-memory.dmp

Download

memory/3188-2-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-8-0x0000000002ED0000-0x0000000002EE2000-memory.dmp

Download

memory/3188-10-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-11-0x000000001C810000-0x000000001CD38000-memory.dmp

Download

memory/3188-18-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-19-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-20-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-22-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3188-1-0x0000000000C60000-0x0000000000D60000-memory.dmp

Download

memory/3188-31-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download