dcrat | c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 00:52

Target

malware.exe
Size

1.9MB
MD5

4825e7df93d8acb3dd236cc14c342a71
SHA1

5cc72cdde2d55a8c5e01ccd80cbb5743bc60ca1b
SHA256

c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e
SHA512

a2e8aa90a719cdddb2f9a4fb21b43f6471cb06e0cb94bd041f26b6a4e11bd820a04c5ea832bb899a91db73d7114b046834afe788d6c03d71b1bf6697272de591
SSDEEP

24576:Ware5SMXhd8zlKNfn6LQrmq4Ku0a7ttoXJZ4pt+NfCgPc52L6cnPmJ9C7CnzpCrk:WvgTW0uNmJPCrjTpM5B3L/q0vlU426n

Score

10^/10

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
rat

Processes:

resource yara_rule

behavioral2/memory/3268-22-0x0000000000400000-0x0000000000456000-memory.dmp dcrat
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

malware.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation malware.exe
Executes dropped EXE 1 IoCs

Processes:

DllHelper.exe

pid process

4260 DllHelper.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

DllHelper.exe

description pid process target process

PID 4260 set thread context of 3268 4260 DllHelper.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4812 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2596 schtasks.exe

resource	yara_rule
behavioral2/memory/3268-22-0x0000000000400000-0x0000000000456000-memory.dmp	dcrat

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	malware.exe

pid	process
4260	DllHelper.exe

description	pid	process	target process
PID 4260 set thread context of 3268	4260	DllHelper.exe	InstallUtil.exe

pid	process
4812	PING.EXE

pid	process
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

malware.exeDllHelper.exeInstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 3268 InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	3268	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

malware.execmd.exeDllHelper.exe

description	pid	process	target process
PID 3016 wrote to memory of 2596	3016	malware.exe	schtasks.exe
PID 3016 wrote to memory of 2596	3016	malware.exe	schtasks.exe
PID 3016 wrote to memory of 2596	3016	malware.exe	schtasks.exe
PID 3016 wrote to memory of 4260	3016	malware.exe	DllHelper.exe
PID 3016 wrote to memory of 4260	3016	malware.exe	DllHelper.exe
PID 3016 wrote to memory of 4260	3016	malware.exe	DllHelper.exe
PID 3016 wrote to memory of 3412	3016	malware.exe	cmd.exe
PID 3016 wrote to memory of 3412	3016	malware.exe	cmd.exe
PID 3016 wrote to memory of 3412	3016	malware.exe	cmd.exe
PID 3412 wrote to memory of 3964	3412	cmd.exe	chcp.com
PID 3412 wrote to memory of 3964	3412	cmd.exe	chcp.com
PID 3412 wrote to memory of 3964	3412	cmd.exe	chcp.com
PID 3412 wrote to memory of 4812	3412	cmd.exe	PING.EXE
PID 3412 wrote to memory of 4812	3412	cmd.exe	PING.EXE
PID 3412 wrote to memory of 4812	3412	cmd.exe	PING.EXE
PID 4260 wrote to memory of 3268	4260	DllHelper.exe	InstallUtil.exe
PID 4260 wrote to memory of 3268	4260	DllHelper.exe	InstallUtil.exe
PID 4260 wrote to memory of 3268	4260	DllHelper.exe	InstallUtil.exe
PID 4260 wrote to memory of 3268	4260	DllHelper.exe	InstallUtil.exe
PID 4260 wrote to memory of 3268	4260	DllHelper.exe	InstallUtil.exe

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\AppVerif\DllHelper.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\malware.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3412

memory/3016-1-0x00000000028E0000-0x0000000002A82000-memory.dmp

Filesize
1.6MB

Download
memory/3016-2-0x00000000028E0000-0x0000000002A82000-memory.dmp

Filesize
1.6MB

Download
memory/3268-20-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3268-22-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3268-23-0x00000000061A0000-0x0000000006744000-memory.dmp

Filesize
5.6MB

Download
memory/4260-16-0x0000000002350000-0x00000000024FC000-memory.dmp

Filesize
1.7MB

Download
memory/4260-17-0x0000000002350000-0x00000000024FC000-memory.dmp

Filesize
1.7MB

Download
memory/4260-18-0x0000000010FB0000-0x00000000112A6000-memory.dmp

Filesize
3.0MB

Download
memory/4260-19-0x0000000010FB0000-0x00000000112A6000-memory.dmp

Filesize
3.0MB

Download