dcrat | c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malware.exe
Size

1.9MB
MD5

4825e7df93d8acb3dd236cc14c342a71
SHA1

5cc72cdde2d55a8c5e01ccd80cbb5743bc60ca1b
SHA256

c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e
SHA512

a2e8aa90a719cdddb2f9a4fb21b43f6471cb06e0cb94bd041f26b6a4e11bd820a04c5ea832bb899a91db73d7114b046834afe788d6c03d71b1bf6697272de591
SSDEEP

24576:Ware5SMXhd8zlKNfn6LQrmq4Ku0a7ttoXJZ4pt+NfCgPc52L6cnPmJ9C7CnzpCrk:WvgTW0uNmJPCrjTpM5B3L/q0vlU426n

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2476-22-0x0000000000400000-0x0000000000456000-memory.dmp	dcrat
behavioral1/memory/2476-21-0x0000000000400000-0x0000000000456000-memory.dmp	dcrat
behavioral1/memory/2476-20-0x0000000000400000-0x0000000000456000-memory.dmp	dcrat

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2564 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

DllHelper.exe

pid process

1688 DllHelper.exe
Loads dropped DLL 2 IoCs

Processes:

malware.exe

pid process

2332 malware.exe
2332 malware.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

DllHelper.exe

description pid process target process

PID 1688 set thread context of 2476 1688 DllHelper.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2800 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2848 schtasks.exe
Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

malware.exeDllHelper.exeInstallUtil.exe

pid process

2332 malware.exe
2332 malware.exe
2332 malware.exe
2332 malware.exe
2332 malware.exe
1688 DllHelper.exe
1688 DllHelper.exe
1688 DllHelper.exe
1688 DllHelper.exe
1688 DllHelper.exe
2476 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 2476 InstallUtil.exe

pid	process
2564	cmd.exe

pid	process
1688	DllHelper.exe

pid	process
2332	malware.exe
2332	malware.exe

description	pid	process	target process
PID 1688 set thread context of 2476	1688	DllHelper.exe	InstallUtil.exe

pid	process
2800	PING.EXE

pid	process
2848	schtasks.exe

pid	process
2332	malware.exe
2332	malware.exe
2332	malware.exe
2332	malware.exe
2332	malware.exe
1688	DllHelper.exe
1688	DllHelper.exe
1688	DllHelper.exe
1688	DllHelper.exe
1688	DllHelper.exe
2476	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2476	InstallUtil.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

malware.execmd.exeDllHelper.exe

description	pid	process	target process
PID 2332 wrote to memory of 2848	2332	malware.exe	schtasks.exe
PID 2332 wrote to memory of 2848	2332	malware.exe	schtasks.exe
PID 2332 wrote to memory of 2848	2332	malware.exe	schtasks.exe
PID 2332 wrote to memory of 2848	2332	malware.exe	schtasks.exe
PID 2332 wrote to memory of 1688	2332	malware.exe	DllHelper.exe
PID 2332 wrote to memory of 1688	2332	malware.exe	DllHelper.exe
PID 2332 wrote to memory of 1688	2332	malware.exe	DllHelper.exe
PID 2332 wrote to memory of 1688	2332	malware.exe	DllHelper.exe
PID 2332 wrote to memory of 2564	2332	malware.exe	cmd.exe
PID 2332 wrote to memory of 2564	2332	malware.exe	cmd.exe
PID 2332 wrote to memory of 2564	2332	malware.exe	cmd.exe
PID 2332 wrote to memory of 2564	2332	malware.exe	cmd.exe
PID 2564 wrote to memory of 2656	2564	cmd.exe	chcp.com
PID 2564 wrote to memory of 2656	2564	cmd.exe	chcp.com
PID 2564 wrote to memory of 2656	2564	cmd.exe	chcp.com
PID 2564 wrote to memory of 2656	2564	cmd.exe	chcp.com
PID 2564 wrote to memory of 2800	2564	cmd.exe	PING.EXE
PID 2564 wrote to memory of 2800	2564	cmd.exe	PING.EXE
PID 2564 wrote to memory of 2800	2564	cmd.exe	PING.EXE
PID 2564 wrote to memory of 2800	2564	cmd.exe	PING.EXE
PID 1688 wrote to memory of 2468	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2468	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2468	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2468	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2468	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2468	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2468	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2476	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2476	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2476	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2476	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2476	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2476	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2476	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2476	1688	DllHelper.exe	InstallUtil.exe
PID 1688 wrote to memory of 2476	1688	DllHelper.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\malware.exe
"C:\Users\Admin\AppData\Local\Temp\malware.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\AppVerif\DllHelper.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Users\Admin\AppVerif\DllHelper.exe
"C:\Users\Admin\AppVerif\DllHelper.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
3⤵
PID:2468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\malware.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:2656

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2800

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-15-0x0000000002080000-0x000000000221F000-memory.dmp

Filesize
1.6MB

Download
memory/1688-23-0x0000000002080000-0x000000000221F000-memory.dmp

Filesize
1.6MB

Download
memory/1688-17-0x000000000BB70000-0x000000000BE66000-memory.dmp

Filesize
3.0MB

Download
memory/1688-16-0x0000000002080000-0x000000000221F000-memory.dmp

Filesize
1.6MB

Download
memory/1688-14-0x0000000002080000-0x000000000221F000-memory.dmp

Filesize
1.6MB

Download
memory/2332-13-0x0000000000850000-0x00000000009EF000-memory.dmp

Filesize
1.6MB

Download
memory/2332-0-0x0000000000850000-0x00000000009EF000-memory.dmp

Filesize
1.6MB

Download
memory/2332-2-0x0000000000850000-0x00000000009EF000-memory.dmp

Filesize
1.6MB

Download
memory/2332-1-0x0000000000850000-0x00000000009EF000-memory.dmp

Filesize
1.6MB

Download
memory/2476-18-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2476-22-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2476-21-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2476-20-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download