dcrat | 089d616e719fe865bfa343a74caeb7eddb1387c020dc51d3d62596bf6a97cabe

General

Target
031E2CA44B863FA57D03EE69B3CF6260.exe
Size 827KB
Sample260915-rgvy1aybke
SHA256 089d616e719fe865bfa343a74caeb7eddb1387c020dc51d3d62596bf6a97cabe
MD5 031e2ca44b863fa57d03ee69b3cf6260
SHA1 634e206a1c4098365af2a08b1fb5972c827a218c
SHA512 fdc5c7bd0065ecd5f89145ce10ee6d9431fdd523c8e4b7be4ee77d49f8741673db793cf579dd2d7c9545749af2b88a6bcfa9b12dd06065081237732d7ca8a7ea
SSDEEP 12288:I0Yu9s2LYgmHRY0t9vfijo8gQFj8EOvNI0S391nxAW0G:RT9vCH+0txifxA91IPt52G
TLSH
T11505E7017E84CE12F0091633C2EF854887F4AC91A6A6E72B7DBA376D55123A77C1D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/4924-0-0x0000000000030000-0x0000000000106000-memory.dmp	dcrat
behavioral1/files/0x000700000002460a-10.dat	dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5876	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5944	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5776	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5804	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5136	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5716	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5852	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5512	628	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5884	628	schtasks.exe	83

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	980	services.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	031E2CA44B863FA57D03EE69B3CF6260.exe

Executes dropped EXE 8 IoCs

pid	Process
980	services.exe
5724	upfc.exe
5656	SearchApp.exe
5740	backgroundTaskHost.exe
3848	Idle.exe
1420	csrss.exe
1124	services.exe
4156	backgroundTaskHost.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ipinfo.io
4	ipinfo.io

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/980-43-0x000000001C430000-0x000000001C440000-memory.dmp	SmartAssembly

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\upfc.exe	031E2CA44B863FA57D03EE69B3CF6260.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ea1d8f6d871115	031E2CA44B863FA57D03EE69B3CF6260.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PLA\Rules\en-US\services.exe	031E2CA44B863FA57D03EE69B3CF6260.exe
File created	C:\Windows\PLA\Rules\en-US\c5b4cb5e9653cc	031E2CA44B863FA57D03EE69B3CF6260.exe
File created	C:\Windows\PLA\Rules\en-US\services.exe	031E2CA44B863FA57D03EE69B3CF6260.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3604	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	031E2CA44B863FA57D03EE69B3CF6260.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4732	schtasks.exe
2680	schtasks.exe
3952	schtasks.exe
3088	schtasks.exe
540	schtasks.exe
1992	schtasks.exe
4540	schtasks.exe
2940	schtasks.exe
5876	schtasks.exe
3616	schtasks.exe
5944	schtasks.exe
2132	schtasks.exe
5136	schtasks.exe
5716	schtasks.exe
2336	schtasks.exe
5512	schtasks.exe
5776	schtasks.exe
5804	schtasks.exe
4088	schtasks.exe
5852	schtasks.exe
5884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4924	031E2CA44B863FA57D03EE69B3CF6260.exe
4924	031E2CA44B863FA57D03EE69B3CF6260.exe
4924	031E2CA44B863FA57D03EE69B3CF6260.exe
980	services.exe
980	services.exe
980	services.exe
980	services.exe
980	services.exe
980	services.exe
980	services.exe
980	services.exe
980	services.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
980	services.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	031E2CA44B863FA57D03EE69B3CF6260.exe
Token: SeDebugPrivilege	980	services.exe
Token: SeDebugPrivilege	5656	SearchApp.exe
Token: SeDebugPrivilege	5740	backgroundTaskHost.exe
Token: SeDebugPrivilege	5724	upfc.exe
Token: SeDebugPrivilege	3848	Idle.exe
Token: SeDebugPrivilege	1124	services.exe
Token: SeDebugPrivilege	1420	csrss.exe
Token: SeDebugPrivilege	4156	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3604	4924	031E2CA44B863FA57D03EE69B3CF6260.exe	112
PID 3604 wrote to memory of 5692	3604	cmd.exe	117
PID 3604 wrote to memory of 4156	3604	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\031E2CA44B863FA57D03EE69B3CF6260.exe
"C:\Users\Admin\AppData\Local\Temp\031E2CA44B863FA57D03EE69B3CF6260.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QWYW0WHwpB.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5692
- - C:\Users\Default\My Documents\backgroundTaskHost.exe
    "C:\Users\Default\My Documents\backgroundTaskHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\Rules\en-US\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\PLA\Rules\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\Rules\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Templates\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Templates\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Templates\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Saved Games\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default\My Documents\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Users\Default\My Documents\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Public\Libraries\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Libraries\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5884

C:\Windows\PLA\Rules\en-US\services.exe
"C:\Windows\PLA\Rules\en-US\services.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\upfc.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\upfc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5724

C:\Users\Public\Libraries\SearchApp.exe
"C:\Users\Public\Libraries\SearchApp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5656

C:\Users\Default\My Documents\backgroundTaskHost.exe
"C:\Users\Default\My Documents\backgroundTaskHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5740

C:\Users\All Users\Oracle\Java\.oracle_jre_usage\Idle.exe
"C:\Users\All Users\Oracle\Java\.oracle_jre_usage\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Users\Default\Saved Games\csrss.exe
"C:\Users\Default\Saved Games\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Users\Admin\Templates\services.exe
"C:\Users\Admin\Templates\services.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

QWYW0WHwpB.bat

Path C:\Users\Admin\AppData\Local\Temp\QWYW0WHwpB.bat
Size 217B
SHA256 40272b5b6ca518b2e9f92585ee84cc442ffee3eb55e120c21e7d21182aed5086
MD5 b52b2d4135dae59b979e28d32dd90982
SHA1 e49b908b79794fe06e86ae5d94f90e5035555e9f
SHA512 f6fb5c10827dd3666a6e6c6906c2b35252ae32f0540ef7ea43426786e72a3cbd08faef3938ba7fd57dc75efa1d239c66c8f3f50bb4528d74f6e35189b9141b81
TLSH
T1FCD023535041C60A15431D130575024D60571C4CB6C13F50035D587C255746D71DFBC1
MD5 SHA1 SHA512 TLSH

Submit Download

csrss.exe

Path C:\Users\Default\Saved Games\csrss.exe
Size 827KB
SHA256 089d616e719fe865bfa343a74caeb7eddb1387c020dc51d3d62596bf6a97cabe
MD5 031e2ca44b863fa57d03ee69b3cf6260
SHA1 634e206a1c4098365af2a08b1fb5972c827a218c
SHA512 fdc5c7bd0065ecd5f89145ce10ee6d9431fdd523c8e4b7be4ee77d49f8741673db793cf579dd2d7c9545749af2b88a6bcfa9b12dd06065081237732d7ca8a7ea
SSDEEP 12288:I0Yu9s2LYgmHRY0t9vfijo8gQFj8EOvNI0S391nxAW0G:RT9vCH+0txifxA91IPt52G
TLSH
T11505E7017E84CE12F0091633C2EF854887F4AC91A6A6E72B7DBA376D55123A77C1D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/980-43-0x000000001C430000-0x000000001C440000-memory.dmp

Download

memory/4924-0-0x0000000000030000-0x0000000000106000-memory.dmp

Download

memory/4924-1-0x000000001AD60000-0x000000001AD70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads