File name: | b4a51418a774a766137e7fa75a0ce6ab.exe |
Full analysis: | https://app.any.run/tasks/6bd7204f-0ae7-45eb-9521-18281e75a28e |
Verdict: | Malicious activity |
Threats: | DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common. |
Analysis date: | April 01, 2023, 04:52:46 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | B4A51418A774A766137E7FA75A0CE6AB |
SHA1: | 346AA7732D0E56614289D4B46DDB2D699FCE0DEC |
SHA256: | 9A341AD8B4BEC65E5426D01D02776A351C3834F4BEC8B2E7697CE70BADDFEBCD |
SSDEEP: | 24576:O2G/nvxW3Ww0tGjiRdpVWXhSsxcwUPkffThANFkY/uoHMqo:ObA30GedpV4SsxzUszhwLGoHMJ |
.exe | | | InstallShield setup (53.2) |
---|---|---|
.exe | | | Win32 Executable Delphi generic (17.5) |
.scr | | | Windows screen saver (16.1) |
.exe | | | Win32 Executable (generic) (5.5) |
.exe | | | Win16/32 Executable Delphi generic (2.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 1992:06:19 22:22:17+00:00 |
ImageFileCharacteristics: | Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
PEType: | PE32 |
LinkerVersion: | 2.25 |
CodeSize: | 5120 |
InitializedDataSize: | 1245184 |
UninitializedDataSize: | - |
EntryPoint: | 0x20cc |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 19-Jun-1992 22:22:17 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 8 |
Time date stamp: | 19-Jun-1992 22:22:17 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
CODE | 0x00001000 | 0x000013B8 | 0x00001400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.34099 |
DATA | 0x00003000 | 0x0000007C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.11763 |
BSS | 0x00004000 | 0x00000695 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x00005000 | 0x00000302 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.47732 |
.tls | 0x00006000 | 0x00000004 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x00007000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 0.199108 |
.reloc | 0x00008000 | 0x000001C8 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 5.7833 |
.rsrc | 0x00009000 | 0x0012F4FC | 0x0012F600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 6.5315 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
A1 | 6.53197 | 1241797 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
B1 | 4.1643 | 35 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
C1 | 0 | 1 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
D1 | 0 | 1 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
DVCLAL | 4 | 16 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
E1 | 0 | 1 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
PACKAGEINFO | 4.08834 | 56 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
kernel32.dll |
shell32.dll |
shfolder.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1376 | "C:\Users\admin\AppData\Local\Temp\b4a51418a774a766137e7fa75a0ce6ab.exe" | C:\Users\admin\AppData\Local\Temp\b4a51418a774a766137e7fa75a0ce6ab.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
596 | "C:\Users\admin\AppData\Local\Temp\Windows Driver Foundation (WDF).exe" | C:\Users\admin\AppData\Local\Temp\Windows Driver Foundation (WDF).exe | b4a51418a774a766137e7fa75a0ce6ab.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
1200 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Windows\BVHTprimxG0zwz49LhrmEC6BsWD.vbe" | C:\Windows\SysWOW64\wscript.exe | — | Windows Driver Foundation (WDF).exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
1260 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Windows\hlXC2FInD0MhsFNJzolev0pWo.bat" " | C:\Windows\SysWOW64\cmd.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1200 | "C:\Users\admin\AppData\Local\Temp\Windows\Windows Driver Foundation (WDF).exe" | C:\Users\admin\AppData\Local\Temp\Windows\Windows Driver Foundation (WDF).exe | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.1.1o Modules
| |||||||||||||||
1936 | schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\Sample Pictures\spoolsv.exe'" /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1612 | schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\spoolsv.exe'" /rl HIGHEST /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2148 | schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\Sample Pictures\spoolsv.exe'" /rl HIGHEST /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2324 | schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\admin\Start Menu\conhost.exe'" /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2408 | schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\admin\Start Menu\conhost.exe'" /rl HIGHEST /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (1376) b4a51418a774a766137e7fa75a0ce6ab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1376) b4a51418a774a766137e7fa75a0ce6ab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (1376) b4a51418a774a766137e7fa75a0ce6ab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (1376) b4a51418a774a766137e7fa75a0ce6ab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (596) Windows Driver Foundation (WDF).exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (596) Windows Driver Foundation (WDF).exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (596) Windows Driver Foundation (WDF).exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (596) Windows Driver Foundation (WDF).exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1200) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1200) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1200 | Windows Driver Foundation (WDF).exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\088424020bedd6 | text | |
MD5:E629AC05BAF7D85BE2CE76CFA683802C | SHA256:BADEF868E7532E6CDD9AE933C74E639D3EDCA2CEEB41AE0FB956E89304E7BB75 | |||
1200 | Windows Driver Foundation (WDF).exe | C:\Windows\debug\WIA\0bcb650e8adc8c | text | |
MD5:79514FDAD9096F09EFF7CF558781F723 | SHA256:9A7FB9419DBA7BEDD19AEBB5CE7A65ADE0006AA1332DEF550B4DDC8A4C53B9A0 | |||
1200 | Windows Driver Foundation (WDF).exe | C:\Windows\debug\WIA\1173b9a28a9c10 | text | |
MD5:376F06F9B9579DAB089E131CC9057988 | SHA256:2BB8F37A32797A62DD83B59905F88C50F840E525E7ADC9F0C9CB1ADC568F4BE2 | |||
1200 | Windows Driver Foundation (WDF).exe | C:\Users\Public\Recorded TV\Sample Media\6ccacd8608530f | text | |
MD5:70CCA25397D5C8C1D5AD776DE8EBB28B | SHA256:E30259AA5BF7931AA1F33D66BADC4F394C5D73F99EEF850E1396E1583849CB31 | |||
1200 | Windows Driver Foundation (WDF).exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\6203df4a6bafc7 | text | |
MD5:8B0EA5EC558F3891EC230AE452BA6261 | SHA256:5B79B0D0DD47B342923EB2907CA602254551B0338BEE7A72863F2E7078773891 | |||
1200 | Windows Driver Foundation (WDF).exe | C:\Users\Public\Pictures\Sample Pictures\f3b6ecef712a24 | text | |
MD5:8B20E771185FC17814A3946A80F3EE57 | SHA256:7E54A8A0CE713BF6F2A7ED5082F9E9093C3BD0C91369D1107B8339654A73BEFC | |||
1200 | Windows Driver Foundation (WDF).exe | C:\Users\admin\AppData\Local\Temp\P4d6soi8LF | text | |
MD5:A7C0C98DF840EB1083B76B46636F2564 | SHA256:94E2411CBF71D06D36660EB774AD13C42FD52949CF07289A39140EDB2EA13064 | |||
1200 | Windows Driver Foundation (WDF).exe | C:\Users\admin\AppData\Local\Temp\ByuAs1jpR6.bat | text | |
MD5:8B50F9BE8E833711E3BB9A858049721C | SHA256:92BE46C75C2E0CA5973EC0A89E9C064D1BAB808AF338F191A936EF067A79B153 | |||
596 | Windows Driver Foundation (WDF).exe | C:\Users\admin\AppData\Local\Temp\Windows\hlXC2FInD0MhsFNJzolev0pWo.bat | text | |
MD5:476A2873C2E5730D104D12C38E852C22 | SHA256:73149F12F4537EB03CD52E18B8CE4322F8D2D61542301EA9A33432FF5CAD8CAE | |||
596 | Windows Driver Foundation (WDF).exe | C:\Users\admin\AppData\Local\Temp\Windows\Windows Driver Foundation (WDF).exe | executable | |
MD5:D0C133555FAE9D5612D11E5B7DBF8482 | SHA256:4B23F7BC07FD2CD707AA84FF7B8B7EDE9C47567C1C921F8E6FC3477E5745499E |