File name: | 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample |
Full analysis: | https://app.any.run/tasks/7a8f902f-256c-4fbd-8c1c-0326bcd0e36a |
Verdict: | Malicious activity |
Threats: | DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common. |
Analysis date: | January 10, 2025, 18:18:02 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32+ executable (GUI) x86-64, for MS Windows, 7 sections |
MD5: | C8228B107DFAD48C1A7DE8147FA1F6E4 |
SHA1: | 7F6D1D3C48D891CCCC4B0DD57504DB216AC681A8 |
SHA256: | 8D0C8954ABEAA3C75C922544E9798171DE09868A3A1F9300E07465672ADA3DA4 |
SSDEEP: | 98304:wejdruhJbuBaFJ5w8aKq6fXVivHUb7ooytsbjK9L6WB0vaC02KvEzhKdZ4/bVufk:EAy |
.exe | | | Win64 Executable (generic) (87.3) |
---|---|---|
.exe | | | Generic Win/DOS Executable (6.3) |
.exe | | | DOS Executable Generic (6.3) |
MachineType: | AMD AMD64 |
---|---|
TimeStamp: | 2024:12:24 09:42:13+00:00 |
ImageFileCharacteristics: | Executable, Large address aware |
PEType: | PE32+ |
LinkerVersion: | 14.41 |
CodeSize: | 287744 |
InitializedDataSize: | 171520 |
UninitializedDataSize: | - |
EntryPoint: | 0x327e0 |
OSVersion: | 5.2 |
ImageVersion: | - |
SubsystemVersion: | 5.2 |
Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6060 | "C:\Users\admin\AppData\Local\Temp\8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe" | C:\Users\admin\AppData\Local\Temp\8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
5916 | "C:\Users\admin\AppData\Local\Temp\RarSFX0\cNeeds\cData\o4e4cli\f5Mb10zb.exe" | C:\Users\admin\AppData\Local\Temp\RarSFX0\cNeeds\cData\o4e4cli\f5Mb10zb.exe | 8d0c8954abeaa3c75c922544e9798171de09868a3a1f9300e07465672ada3da4.exe.sample.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
2996 | "C:\WINDOWS\System32\WScript.exe" "C:\mshypercomponentSavesdll\kNSe5xQ3wI9ft6pWJZ9EeFYPDfgbdbVMsQk13JHxpBJ7xdPC40.vbe" | C:\Windows\SysWOW64\wscript.exe | — | f5Mb10zb.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
2280 | C:\WINDOWS\system32\cmd.exe /c ""C:\mshypercomponentSavesdll\1fgSUpJ8Uk5BF.bat" " | C:\Windows\SysWOW64\cmd.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
4548 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
3812 | "C:\mshypercomponentSavesdll/agentFont.exe" | C:\mshypercomponentSavesdll\agentFont.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.2.7.1277 Modules
| |||||||||||||||
6212 | "C:\Windows\System32\cmd.exe" /c "C:\mshypercomponentSavesdll\agentFont.exe" | C:\Windows\System32\cmd.exe | agentFont.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6220 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6336 | C:\mshypercomponentSavesdll\agentFont.exe | C:\mshypercomponentSavesdll\agentFont.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.2.7.1277 Modules
| |||||||||||||||
6588 | schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\Provisioning\wininit.exe'" /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (5916) f5Mb10zb.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids |
Operation: | write | Name: | VBEFile |
Value: | |||
(PID) Process: | (6336) agentFont.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\000e8114dab6badcc03fe652fd99762cd2a8cffa |
Operation: | write | Name: | fd3d709e264a2408002fc055ad4465fa3c0a85b0 |
Value: H4sIAAAAAAAEAI2PTQvCMAyG/0rxpCBjXkS8iaCXCYMhHoyHssYt2DbSdFP/vcUvdvT0voE85MlxtF4CHMgbvglAGbgnIfbkG4AbpaSY4R1H09fimTtvsjzPAQyFlLOsbi8A1UMiugpjTKAMACft44qhZndljz5Wukcx1n6RwepeMCSFlbXqU8tivwUouEk9MS3L0CW5NkE7tSGLosb3xXzy+0TtOhvJoSGtSqvjmYMDqCXIf3K6SeOG/fve6QnLXvwUJgEAAA== | |||
(PID) Process: | (6336) agentFont.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.FriendlyAppName |
Value: Windows Command Processor | |||
(PID) Process: | (6336) agentFont.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.ApplicationCompany |
Value: Microsoft Corporation | |||
(PID) Process: | (1412) csrss.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (1412) csrss.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32 |
Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
(PID) Process: | (1412) csrss.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (1412) csrss.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (1412) csrss.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
(PID) Process: | (1412) csrss.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\csrss_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6336 | agentFont.exe | C:\mshypercomponentSavesdll\27d1bcfc3c54e0 | text | |
MD5:197CE29E8EC98AA712883E8E62A48B1A | SHA256:45B3DD5904372D006DFD20A30EE9C3FDD5A9A5DA4FEB0652E0CE51FD1B7E8F83 | |||
6336 | agentFont.exe | C:\Program Files (x86)\Windows Multimedia Platform\886983d96e3d3e | text | |
MD5:15654E93F9801EDE51E4C8F643A21AF7 | SHA256:9E69A76DD65C53E22016151AADAA44127BACE53589CE4697450900CCAE980599 | |||
6336 | agentFont.exe | C:\ProgramData\PLUG\Logs\5940a34987c991 | text | |
MD5:906BDD37D63666EEFC0B41D9A3D915C9 | SHA256:010E92395AF76B28EC0864DDE4671DC22D606CEC7781081183D13A3E3A31B613 | |||
3812 | agentFont.exe | C:\Users\admin\Desktop\FzVjqPOJ.log | executable | |
MD5:D8BF2A0481C0A17A634D066A711C12E9 | SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669 | |||
6336 | agentFont.exe | C:\Users\admin\Desktop\gUvWtVBF.log | executable | |
MD5:D8BF2A0481C0A17A634D066A711C12E9 | SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669 | |||
6336 | agentFont.exe | C:\mshypercomponentSavesdll\e6dd04281f4893 | text | |
MD5:3AA8DF7BD1BF125FAF9C41F7812A3C23 | SHA256:D6BFA336DD1E7D412C1A9F51BFC361FC8409C046116F3764866ED7BC26097BE3 | |||
6336 | agentFont.exe | C:\Users\admin\Desktop\XdsoeKVS.log | executable | |
MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0 | SHA256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254 | |||
5916 | f5Mb10zb.exe | C:\mshypercomponentSavesdll\kNSe5xQ3wI9ft6pWJZ9EeFYPDfgbdbVMsQk13JHxpBJ7xdPC40.vbe | binary | |
MD5:06FA0952379DC4DB1439AF29A13D89BE | SHA256:CFE1D4E4F8C609281567BCBA5CC5117FA957D53721B817F979092DEC7FC44852 | |||
5916 | f5Mb10zb.exe | C:\mshypercomponentSavesdll\agentFont.exe | executable | |
MD5:0D30B2D3FD8DB7AE5EDC0455DA8DC8E9 | SHA256:23DFBD08FCA53DCB25B0F76B6D24ABF02EB2349BC43C975BACD3776B52241FAF | |||
3812 | agentFont.exe | C:\Users\admin\Desktop\XcEHZHdb.log | executable | |
MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0 | SHA256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.169:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.169:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.169:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1412 | csrss.exe | POST | 200 | 37.44.238.250:80 | http://487997cm.renyash.top/VideoFlowergeneratorTestpublic.php | unknown | — | — | malicious |
1412 | csrss.exe | POST | 200 | 37.44.238.250:80 | http://487997cm.renyash.top/VideoFlowergeneratorTestpublic.php | unknown | — | — | malicious |
4712 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1412 | csrss.exe | POST | 200 | 37.44.238.250:80 | http://487997cm.renyash.top/VideoFlowergeneratorTestpublic.php | unknown | — | — | malicious |
6968 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.48.23.169:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.48.23.169:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
1176 | svchost.exe | 20.190.159.4:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1176 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1076 | svchost.exe | 23.213.166.81:443 | go.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
487997cm.renyash.top |
| malicious |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
— | — | A Network Trojan was detected | ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST) |
— | — | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |