File name: | DC Rat.exe |
Full analysis: | https://app.any.run/tasks/a5576253-1d0f-4162-90ed-9853dd9d7210 |
Verdict: | Malicious activity |
Threats: | DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common. |
Analysis date: | April 01, 2023, 09:21:39 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 54C6B64CB242FC9E210578980C59C0EE |
SHA1: | 1DC98A41B748F67C73FD7BE8D702DFC60E7C8305 |
SHA256: | D56BC8947BD949294EEB0B4191B94BEB2553E5972C72587DDD215EBAF899354B |
SSDEEP: | 24576:52G/nvxW3W60GnMGAa6h5QcxfImbaPaoVRhL0b7wTy:5bA3+G7AScxfIuaiod6 |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x1ec40 |
UninitializedDataSize: | - |
InitializedDataSize: | 344064 |
CodeSize: | 201216 |
LinkerVersion: | 14 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, 32-bit |
TimeStamp: | 2020:12:01 18:00:55+00:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 01-Dec-2020 18:00:55 |
Detected languages: |
|
Debug artifacts: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000118 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 6 |
Time date stamp: | 01-Dec-2020 18:00:55 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000310EA | 0x00031200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.70808 |
.rdata | 0x00033000 | 0x0000A612 | 0x0000A800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.22174 |
.data | 0x0003E000 | 0x00023728 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.70882 |
.didat | 0x00062000 | 0x00000188 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.29825 |
.rsrc | 0x00063000 | 0x00046168 | 0x00046200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.50829 |
.reloc | 0x000AA000 | 0x00002268 | 0x00002400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.55486 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.26192 | 1875 | Latin 1 / Western European | English - United States | RT_MANIFEST |
7 | 3.1586 | 482 | Latin 1 / Western European | English - United States | RT_STRING |
8 | 3.11685 | 460 | Latin 1 / Western European | English - United States | RT_STRING |
9 | 3.11236 | 440 | Latin 1 / Western European | English - United States | RT_STRING |
10 | 2.99727 | 326 | Latin 1 / Western European | English - United States | RT_STRING |
11 | 3.2036 | 1094 | Latin 1 / Western European | English - United States | RT_STRING |
12 | 3.12889 | 358 | Latin 1 / Western European | English - United States | RT_STRING |
13 | 3.01704 | 338 | Latin 1 / Western European | English - United States | RT_STRING |
14 | 2.94627 | 266 | Latin 1 / Western European | English - United States | RT_STRING |
15 | 2.83619 | 188 | Latin 1 / Western European | English - United States | RT_STRING |
KERNEL32.dll |
USER32.dll (delay-loaded) |
gdiplus.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2824 | "C:\Users\admin\AppData\Local\Temp\DC Rat.exe" | C:\Users\admin\AppData\Local\Temp\DC Rat.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
3376 | "C:\Users\admin\AppData\Local\Temp\DC Rat.exe" | C:\Users\admin\AppData\Local\Temp\DC Rat.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
3624 | "C:\Windows\System32\WScript.exe" "C:\MsSurrogatesavesDllCommon\KNXxoYbYBPxFU.vbe" | C:\Windows\System32\wscript.exe | — | DC Rat.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
372 | C:\Windows\system32\cmd.exe /c ""C:\MsSurrogatesavesDllCommon\8EVty8tFPt0VqMZlz5bMQ6Tt5F96.bat" " | C:\Windows\System32\cmd.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1984 | "C:\MsSurrogatesavesDllCommon\portcomponenthost.exe" | C:\MsSurrogatesavesDllCommon\portcomponenthost.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 5.15.2.0 Modules
| |||||||||||||||
2408 | schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\spoolsv.exe'" /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2940 | schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\spoolsv.exe'" /rl HIGHEST /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3008 | schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\spoolsv.exe'" /rl HIGHEST /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3216 | schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\System.exe'" /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3388 | schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\System.exe'" /rl HIGHEST /f | C:\Windows\System32\schtasks.exe | — | WmiPrvSE.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (3376) DC Rat.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3376) DC Rat.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3376) DC Rat.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3376) DC Rat.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (3624) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3624) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3624) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3624) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1984) portcomponenthost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1984) portcomponenthost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1984 | portcomponenthost.exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\f3b6ecef712a24 | text | |
MD5:D129DAA88731AA5964186D09BB4F87AE | SHA256:F4A8A4DD726D71CAD32D07DE9EABDDD3F2C7DD20B58A5AC6F4A002350782F383 | |||
1984 | portcomponenthost.exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\27d1bcfc3c54e0 | text | |
MD5:63D414FC776C64C909F9119CFFE284FF | SHA256:D6AE782CF331B54D9242F3998D49C82B745CADEEEE9C18B91BC7F909EB60C798 | |||
1984 | portcomponenthost.exe | C:\MSOCache\All Users\088424020bedd6 | text | |
MD5:BAC854E424578BAAED78EA135320332C | SHA256:8E159EC42A3989E7379312F3659CA1ACE29ECD3ACFA84EE051F9E2570439CAC9 | |||
1984 | portcomponenthost.exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\6cb0b6c459d5d3 | text | |
MD5:B303335FD6702AEC3D9CC6D124F1E860 | SHA256:B3CF9B2F516A3246D3AD27875DD0465733FC43D59D5C86302C6FED41C5140A50 | |||
1984 | portcomponenthost.exe | C:\MsSurrogatesavesDllCommon\1173b9a28a9c10 | text | |
MD5:D6538091034564D6D0B55FFA2164EC24 | SHA256:BA7C0622694D11231C0E4DA5979D87C6240659918ADD0C8CF68EF50BF7BC2970 | |||
3376 | DC Rat.exe | C:\MsSurrogatesavesDllCommon\portcomponenthost.exe | executable | |
MD5:2AC0E24EE73528BF8E6205FDBF62CB48 | SHA256:6A8B636D017E1D6DAF0C78B7F46F7B0AB97805A4008301041603F79F6B3CD919 | |||
3376 | DC Rat.exe | C:\MsSurrogatesavesDllCommon\8EVty8tFPt0VqMZlz5bMQ6Tt5F96.bat | text | |
MD5:CE377E811EDF958E24553755294774A8 | SHA256:41C0D44B462F9731A9658A13E91EF3A02B964AF9F16F3C53DAF46441008EAA71 | |||
3376 | DC Rat.exe | C:\MsSurrogatesavesDllCommon\KNXxoYbYBPxFU.vbe | vbe | |
MD5:D123093DB1AD87DCE8D25A1B15CC6F9F | SHA256:ACBAC6EA28763D88CDAA2F1BC1738B8C6149BE7E30D66DB31AFA3BABF3937537 | |||
1984 | portcomponenthost.exe | C:\Program Files\Adobe\6203df4a6bafc7 | text | |
MD5:FCB6C81D70D5BC422D056BD4949C36A3 | SHA256:B904C3CD5A158BF71485678D697E1BA739617B94E4563C554BCCF8B77431F81D | |||
1984 | portcomponenthost.exe | C:\MsSurrogatesavesDllCommon\IMEDICTUPDATE.exe | executable | |
MD5:2AC0E24EE73528BF8E6205FDBF62CB48 | SHA256:6A8B636D017E1D6DAF0C78B7F46F7B0AB97805A4008301041603F79F6B3CD919 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4068 | System.exe | GET | 302 | 5.23.51.104:80 | http://cw31476.tw1.ru/_Defaultwindows.php?IqQTfaxkTvYwiL6e2=gJzsw6kFQj1&msklxdusm7nCY7zEpJo250ipp=4UtZKNtgIqM7Yd&JrigwUyGfaG482wJ45WiZ9Nx=T1zJ2rvLIvI9J3&6ce25700567d2fbcd0392692915406cf=226631b57b949808c698bb9a54ae16b9&9e6ac65a6ff353b0435a3acdfda9417f=QO1QTM5gDMmBTYzIjM4ETY4MDOwcDMmZzY4MjYwImZihDNjhjZ4UWO&IqQTfaxkTvYwiL6e2=gJzsw6kFQj1&msklxdusm7nCY7zEpJo250ipp=4UtZKNtgIqM7Yd&JrigwUyGfaG482wJ45WiZ9Nx=T1zJ2rvLIvI9J3 | RU | html | 145 b | malicious |
4068 | System.exe | GET | 302 | 5.23.51.104:80 | http://cw31476.tw1.ru/_Defaultwindows.php?IqQTfaxkTvYwiL6e2=gJzsw6kFQj1&msklxdusm7nCY7zEpJo250ipp=4UtZKNtgIqM7Yd&JrigwUyGfaG482wJ45WiZ9Nx=T1zJ2rvLIvI9J3&6ce25700567d2fbcd0392692915406cf=226631b57b949808c698bb9a54ae16b9&9e6ac65a6ff353b0435a3acdfda9417f=QO1QTM5gDMmBTYzIjM4ETY4MDOwcDMmZzY4MjYwImZihDNjhjZ4UWO&IqQTfaxkTvYwiL6e2=gJzsw6kFQj1&msklxdusm7nCY7zEpJo250ipp=4UtZKNtgIqM7Yd&JrigwUyGfaG482wJ45WiZ9Nx=T1zJ2rvLIvI9J3 | RU | html | 145 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4068 | System.exe | 5.23.51.104:443 | cw31476.tw1.ru | TimeWeb Ltd. | RU | malicious |
— | — | 5.23.51.104:80 | cw31476.tw1.ru | TimeWeb Ltd. | RU | malicious |
Domain | IP | Reputation |
---|---|---|
cw31476.tw1.ru |
| malicious |
vh302.timeweb.ru |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
4068 | System.exe | A Network Trojan was detected | ET MALWARE DCRAT Activity (GET) |