dcrat | 5b8f511ca8a386c382cd23b305d295ae406a9aae2392f7543de21d5d67c44ced

Resubmissions

01-07-2024 00:40

240701-az927stfrj 10

01-07-2024 00:39

240701-az1tja1arh 10

Analysis

max time kernel
89s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCRatBuild.exe
Size

1.9MB
MD5

469d978118f1a8de4a1a5bb33bc81a93
SHA1

295ce921008c39f1f3f0ac1e1ccde97ad5c0f12e
SHA256

5b8f511ca8a386c382cd23b305d295ae406a9aae2392f7543de21d5d67c44ced
SHA512

7d71ac9b37d6ca74339e6a7b8b08a72ba72b8f7fedce1ed6d80703eafb31dd4d5e70de4118cf719292cb3de9cb5f84b27b79492b95e890df143e0c5c295cbc44
SSDEEP

49152:UbA307leyidFZE7vBekGuQ/kp129bxWEvd0:UbIyh70kF/p12A

Score

10^/10

dcrat evasion infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
rat

Processes:

resource yara_rule

C:\Windows\SysWOW64\WindowsUpdater32\WindowsUpdater.exe dcrat
behavioral1/memory/3192-13-0x0000000000830000-0x00000000009C8000-memory.dmp dcrat
Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

WindowsUpdater.exe

pid process

3192 WindowsUpdater.exe

resource	yara_rule
C:\Windows\SysWOW64\WindowsUpdater32\WindowsUpdater.exe	dcrat
behavioral1/memory/3192-13-0x0000000000830000-0x00000000009C8000-memory.dmp	dcrat

pid	process
3192	WindowsUpdater.exe

Drops file in System32 directory 8 IoCs

Processes:

DCRatBuild.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WindowsUpdater32\PaKX0sN2c4o6GpO5th.bat	DCRatBuild.exe
File opened for modification	C:\Windows\SysWOW64\WindowsUpdater32\PaKX0sN2c4o6GpO5th.bat	DCRatBuild.exe
File created	C:\Windows\SysWOW64\WindowsUpdater32\WindowsUpdater.exe	DCRatBuild.exe
File opened for modification	C:\Windows\SysWOW64\WindowsUpdater32\WindowsUpdater.exe	DCRatBuild.exe
File created	C:\Windows\SysWOW64\WindowsUpdater32\3iwoWLhCbD6ud1McRS6K1aYy.vbe	DCRatBuild.exe
File opened for modification	C:\Windows\SysWOW64\WindowsUpdater32\3iwoWLhCbD6ud1McRS6K1aYy.vbe	DCRatBuild.exe
File opened for modification	C:\Windows\SysWOW64\WindowsUpdater32	DCRatBuild.exe
File created	C:\Windows\SysWOW64\WindowsUpdater32\__tmp_rar_sfx_access_check_240610921	DCRatBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

DCRatBuild.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings DCRatBuild.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1596 reg.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WindowsUpdater.exe

description pid process

Token: SeDebugPrivilege 3192 WindowsUpdater.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	DCRatBuild.exe

pid	process
1596	reg.exe

description	pid	process
Token: SeDebugPrivilege	3192	WindowsUpdater.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

DCRatBuild.exeWScript.execmd.exe

description	pid	process	target process
PID 4548 wrote to memory of 3644	4548	DCRatBuild.exe	WScript.exe
PID 4548 wrote to memory of 3644	4548	DCRatBuild.exe	WScript.exe
PID 4548 wrote to memory of 3644	4548	DCRatBuild.exe	WScript.exe
PID 3644 wrote to memory of 4692	3644	WScript.exe	cmd.exe
PID 3644 wrote to memory of 4692	3644	WScript.exe	cmd.exe
PID 3644 wrote to memory of 4692	3644	WScript.exe	cmd.exe
PID 4692 wrote to memory of 3192	4692	cmd.exe	WindowsUpdater.exe
PID 4692 wrote to memory of 3192	4692	cmd.exe	WindowsUpdater.exe
PID 4692 wrote to memory of 1596	4692	cmd.exe	reg.exe
PID 4692 wrote to memory of 1596	4692	cmd.exe	reg.exe
PID 4692 wrote to memory of 1596	4692	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4548

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\System32\WindowsUpdater32\3iwoWLhCbD6ud1McRS6K1aYy.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\WindowsUpdater32\PaKX0sN2c4o6GpO5th.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\SysWOW64\WindowsUpdater32\WindowsUpdater.exe
"C:\Windows\System32\WindowsUpdater32\WindowsUpdater.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:1596

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WindowsUpdater32\3iwoWLhCbD6ud1McRS6K1aYy.vbe
Filesize
228B

MD5
63cb07f35d5f7618266afc925eb7de22

SHA1
d9b1164485d02481d9e6c9a1929f44b23e84474f

SHA256
22ae6afc678dfa9beda5327d65565ed745c3607869eb4a380ed6736e704b8b07

SHA512
578134e2ac3bd2f8585e9e8f645c000fbea4d520141004062aa0b22004fa7dfbc1a2fbef52fcd2a4e1cdeca5e915fea17b9ea1440a320139472e8807ff8efd64

Download Submit
C:\Windows\SysWOW64\WindowsUpdater32\PaKX0sN2c4o6GpO5th.bat
Filesize
169B

MD5
d754dcc09774b935efb8c95cefee906f

SHA1
046d65d75216a74407496b906d7868dff07711cb

SHA256
8304d11a02ab7a806781f072013febd8d3c5ceba45a94a68d4fd6a7a931d0242

SHA512
e6ee6cf752bd09e97ddff2a238b01d78503e382f0e4d4eced8f1602657b248f1a3c52918bf7ff9c53bff84b2603092279b8e2eaa8e5ad13bac532baf075d11f6

Download Submit
C:\Windows\SysWOW64\WindowsUpdater32\WindowsUpdater.exe
Filesize
1.6MB

MD5
f8b13afa37f458b357656f428af4f3b5

SHA1
2ec5da9160babd67ea388f32c05968b3b749bd9b

SHA256
752c9badfed2e60e84234932aa1eadb052d92217274ba51d306620031030cc58

SHA512
748ddafba98cc65e36f2418ed99197f810903678b4450e5c98909bf067787cdfb02a6389595b0ddd36271ad13fbf97f78466ef7dd88deeec07e1716231e1ef83

Download Submit
memory/3192-12-0x00007FF9C9373000-0x00007FF9C9375000-memory.dmp

Filesize
8KB

Download
memory/3192-13-0x0000000000830000-0x00000000009C8000-memory.dmp

Filesize
1.6MB

Download
memory/3192-14-0x000000001B530000-0x000000001B53E000-memory.dmp

Filesize
56KB

Download