| File name: | dcrat (1).rar |
| Full analysis: | https://app.any.run/tasks/5d0a6020-22f2-4a95-b277-0e235ea177e2 |
| Verdict: | Malicious activity |
| Threats: | DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common. |
| Analysis date: | May 27, 2024, 18:19:58 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | EA1EB993CDBEE55BC15C426032E76241 |
| SHA1: | BB21FF06C8BE4DFBA4B5CF7C7AABD71EC1A497A1 |
| SHA256: | 8BC4D422624113B2AF547B64FA7DF842B821F189CA4D7BAD6E75767FEC4A9E59 |
| SSDEEP: | 393216:KIfGBBlbpVFtgHdTTfnbl4e3F95uBfaqMEvTuaZivnlQtU5v/OT:sbpv2n3oBfaqMErzZRsOT |
MALICIOUS
DCRAT has been detected (YARA)
- javaw.exe (PID: 6732)
SUSPICIOUS
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 6528)
Checks for Java to be installed
- DCRat.exe (PID: 6712)
Drops 7-zip archiver for unpacking
- WinRAR.exe (PID: 6528)
Starts CMD.EXE for commands execution
- javaw.exe (PID: 6732)
Uses WMIC.EXE to obtain data on the base board management (motherboard or system board)
- cmd.exe (PID: 6904)
Uses WMIC.EXE
- cmd.exe (PID: 7092)
- cmd.exe (PID: 2524)
Uses WMIC.EXE to obtain CPU information
- cmd.exe (PID: 1492)
Uses WMIC.EXE to obtain physical disk drive information
- cmd.exe (PID: 2620)
- cmd.exe (PID: 1864)
INFO
Checks supported languages
- DCRat.exe (PID: 6712)
- javaw.exe (PID: 6732)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 6528)
Reads the machine GUID from the registry
- javaw.exe (PID: 6732)
Creates files in the program directory
- javaw.exe (PID: 6732)
Reads the computer name
- javaw.exe (PID: 6732)
Create files in a temporary directory
- javaw.exe (PID: 6732)
Creates files or folders in the user directory
- javaw.exe (PID: 6732)
Reads security settings of Internet Explorer
- WMIC.exe (PID: 6956)
- WMIC.exe (PID: 7136)
- WMIC.exe (PID: 400)
- WMIC.exe (PID: 2528)
- WMIC.exe (PID: 4004)
- WMIC.exe (PID: 5840)
Drops the executable file immediately after the start
- WinRAR.exe (PID: 6528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
130
Monitored processes
25
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 400 | C:\Windows\System32\wbem\wmic.exe CPU get Proc | C:\Windows\System32\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 2147749911 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1012 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1492 | C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe CPU get Proc ��8�Y | C:\Windows\System32\cmd.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 2147749911 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1864 | C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^" | C:\Windows\System32\cmd.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 44213 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2160 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2524 | C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[� ���\� | C:\Windows\System32\cmd.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 44213 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2528 | C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[� ���\� | C:\Windows\System32\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 44213 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2620 | C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\" | C:\Windows\System32\cmd.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 44213 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3528 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4004 | C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^" | C:\Windows\System32\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 44213 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
8 175
Read events
8 151
Write events
24
Delete events
0
Modification events
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\dcrat (1).rar | |||
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E |
| Operation: | write | Name: | @C:\WINDOWS\System32\acppage.dll,-6002 |
Value: Windows Batch File | |||
| (PID) Process: | (6528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
103
Suspicious files
131
Text files
83
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllI.jar | compressed | |
MD5:6316F84BC78D40B138DAB1ADC978CA5D | SHA256:D637E3326F87A173ABD5F51AC98906A3237B9E511D07D31D6AAFCF43F33DAC17 | |||
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\lib\IlIlIIIIIIIlIlllllllIllIIlIIllIllllIIIlIIIlIlIIlIIlIIlIllIlllIlIlIIllIIlIIIIIIIlIIIIIIIIIlIlllIIllIlIIlIIIlIlIlllIIIIIIl.jar | java | |
MD5:FE734F7AB030363362FE3D3BA5E8F913 | SHA256:03EAD999502AEFBF1380BD2E9C4A407ACB7A92A7B2FE61F6995ABA3FCA85EFD4 | |||
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\lib\lllIlIIIIIlIllIlIlIIllIlIIIlIIllIllllIIIIIllIlllIllIIllIIllIllIllIIlIlllllIIlIllIllIIlIIlIIIllIlIlIIlIIIIIIIllIIlllIllIl.jar | compressed | |
MD5:D5EF47C915BEF65A63D364F5CF7CD467 | SHA256:9C287472408857301594F8F7BDA108457F6FDAE6E25C87EC88DBF3012E5A98B6 | |||
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\php\deplister.exe | executable | |
MD5:0B0B2E20F55103E07ECFAD03AE545850 | SHA256:5F8DA6BD4E6B144F2092F48A6A390516C0D4B5928A95D74012FD81A392F3E4A2 | |||
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\lib\IllIIIIllIlIIIIlIlIllIIlIIllIIlIllIIlllllIlllIllIlIIlIIlllIIlIlIlIllIllIIlIIIlIIIllIIIIIllIIlllllIlIIIIIlIIIIIIIIIIIIlII.jar | compressed | |
MD5:5134A2350F58890FFB9DB0B40047195D | SHA256:2D43EB5EA9E133D2EE2405CC14F5EE08951B8361302FDD93494A3A997B508D32 | |||
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\lib\llIlIIIIlIlIlllllIlIIllllIIIlIlIllllIIllllIlllIIlllllIIlIlllIIIIIIlIIllIIIlIlIlllIlIIIlIIIIIllIlllIlllIIllIIllIlIlIIlllI.jar | compressed | |
MD5:FDE38932B12FC063451AF6613D4470CC | SHA256:9967EA3C3D1AEE8DB5A723F714FBA38D2FC26D8553435AB0E1D4E123CD211830 | |||
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\lib\llIlIlIIIllllIIIllllllllllIllIlIlllIIlllIIlllIIllIIllllIlllIIIIIllllIIlllIIllIIIIlIlIlIlIIIlIIIlIlIlIlIIlllIIlllIlIlIlII.jar | compressed | |
MD5:0C8768CDEB3E894798F80465E0219C05 | SHA256:15F36830124FC7389E312CF228B952024A8CE8601BF5C4DF806BC395D47DB669 | |||
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\lib\lIIllIIlIlllIlIlllIlIIlIIIlllllIIlIlIIllIllIlIlllIlIIlIlIlIIllIlIIIIIllIIlIIlIIlIIllIIIlIIllIlIIIIlIlIIlIIlIllIIlIIlIlIl.jar | compressed | |
MD5:D093F94C050D5900795DE8149CB84817 | SHA256:4BEC0794A0D69DEBE2F955BF495EA7C0858AD84CB0D2D549CACB82E70C060CBA | |||
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\lib\lllIIlIlIIlIIllllIIllllIIlIllllIIIlIllllIIllIIIlllIIIIIIlIIlllIIllIllIIlllIlIIlIlIlllIIlllIlllIlIIlIIIllIlllIIIlIIIIIlll.jar | compressed | |
MD5:3E5E8CCCFF7FF343CBFE22588E569256 | SHA256:0F26584763EF1C5EC07D1F310F0B6504BC17732F04E37F4EB101338803BE0DC4 | |||
| 6528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6528.32790\lib\llllIlIIIIIllllIlIIIlIllIlIIIllllIIIllIllllIIlllIlIIIlllIIlIlIlllIIlIIIIlIIIIlllIIlIIlIlIIIIIIIIllllIllIlIIIlIllIlIlIIll.jar | compressed | |
MD5:B50E2C75F5F0E1094E997DE8A2A2D0CA | SHA256:CF4068EBB5ECD47ADEC92AFBA943AEA4EB2FEE40871330D064B69770CCCB9E23 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
7
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2392 | svchost.exe | GET | — | 2.18.31.107:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
— | — | GET | 200 | 2.18.31.107:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
— | — | GET | 200 | 2.21.153.237:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
5140 | MoUsoCoreWorker.exe | GET | 200 | 2.21.153.237:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
5140 | MoUsoCoreWorker.exe | GET | 200 | 2.18.31.107:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
2908 | OfficeClickToRun.exe | POST | 200 | 13.78.111.199:443 | https://self.events.data.microsoft.com/OneCollector/1.0/ | unknown | binary | 9 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
— | — | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2392 | svchost.exe | 2.18.31.107:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
— | — | 2.18.31.107:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
5140 | MoUsoCoreWorker.exe | 2.18.31.107:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
— | — | 2.21.153.237:80 | www.microsoft.com | Akamai International B.V. | FR | unknown |
5140 | MoUsoCoreWorker.exe | 2.21.153.237:80 | www.microsoft.com | Akamai International B.V. | FR | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6732 | javaw.exe | 172.67.163.28:443 | c3lestial.fun | CLOUDFLARENET | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
c3lestial.fun |
| unknown |
self.events.data.microsoft.com |
| whitelisted |