DarkCrystal RAT Malware Becomes a Low-Cost, Highly Efficient Attack Tool

Remote Access Trojans (RATs) are one of the most common tools used by attackers to target host systems and steal information. DarkCrystal RAT (DCRat) is a prime example of this, offering remote access, post-exploitation, and data exfiltration capabilities.

DCRat is one of several underground commercial RAT tools used by threat groups to target networks and enterprises. It has also become quite prevalent in campaigns targeting Ukrainian organisations. Typically, in the first stage of an attack, the payload is delivered via spear-phishing emails.

▍Spear-Phishing

The Dark Crystal RAT infection chain commonly begins with a victim being tricked into opening a malicious Microsoft Excel ".xls" office document. This type of document can contain macro code that drops and executes a batch script named "c:\user\public\new.bat". This script will execute an embedded PowerShell script, which downloads the second-stage payload responsible for downloading and executing the actual DCRAT malware on the infected host.

The script in the figure below is a base64-encoded PowerShell script downloader.

Macro code and batch script

▍DCRat Analysis

This malware is a .NET compiled assembly that utilises multithreading to execute its malicious operations concurrently on the infected host. As RAT malware, it possesses several capabilities to collect data, steal information, and even execute post-exploitation payloads and plug-ins.

The following are some of the notable behaviours of the RAT malware we identified during our analysis.

Initial Configuration

DCRat decodes and decompresses the configuration data embedded within the binary file. This configuration determines which mutexes and DCRat features are enabled in this compiled DCRat malware. The decoded and decompressed values of its configuration data are shown below.

We can see that the mutex name for this malware sample is "DCR_MUTEX-PNY1ZVhO2iPJoDxTnEBp", and the enabled feature set includes "Screenshot", "Telemetry", "Clipboard", and "System Information".

Afterwards, it decompresses and decodes another set of encoded data, which consists of 2 URL links used for downloading and beaconing communication with its C&C server. If the initial beacon and C&C do not send back data, it will terminate its process. The image below is a screenshot of the decoded URL links and how they form the beacon traffic.

Decoded URL links

The figure below shows how this DCRAT malware variant decodes and decompresses its configuration data. It demonstrates the use of the Base64 encoding algorithm and compression streams to conceal its configuration data.

Persistence

DCRat is also capable of leveraging three different techniques to achieve persistence on the infected host. Its methods include: creating scheduled tasks, creating registry Run keys, and creating Winlogon autostart registry keys.

Persistence entry code

W32tm Time Delay

DCRat also drops a .bat file containing a script that runs the W32tm "stripchart" command on the infected host. This command is used as a delay tactic for its execution and beaconing.

In a production network, ordinary users would typically not use this command, which is why it serves as a good and important alert of possible DCRAT malware execution.

The figure below shows the code for the w32tm stripchart command, which will run alongside the "runas" command.

w32tm stripchart command code

Data Collection

DCRat gathers sensitive information from the compromised host, which is sent to its command-and-control server. The figure below shows the code for collecting the following data:

• server type

• Name, username, isadmin

• GPU info, CPU info, webcam and much more

It will also gather information related to common third-party applications, such as Steam user, Steam user ID, Telegram path, Discord path, webcam, and microphone.

Code to parse this information

The figure below shows how DCRat gathers public IP addresses from the compromised host by accessing an IP web service named "https[:]//ipinfo[.]io/json".

The figure below shows the structure of backdoor commands, where hashes are used to determine which RAT function to execute. This is an excellent anti-analysis technique, especially when the C&C server has been taken down, as the hashing algorithm makes it difficult to reverse the hashes back to their string commands.

Structure of backdoor commands

In order to retrieve the backdoor command strings from these hash values, we recovered some backdoor command strings, as shown in the figure below.

Below is a brief list of the commands we recovered and a short description of what they attempt to execute. These commands can be executed on the server-side of the DCRAT agent to perform specific DCRAT functions.

TTP Analysis Summary

▍Indicators of Compromise (IOC)

▍Conclusion

DCRat, or the Dark Crystal Remote Administration Tool, is a powerful and highly versatile command-and-control malware. This type of threat software is currently sold at low prices on various underground forums, providing attackers with low-cost, effective tools that allow them to perform exploitation and post-exploitation techniques typically only found in expensive commercial tools or highly skilled attacks.

Underground threat groups continuously develop new tools available for purchase because cyber threats are clearly profitable for many organisations. These tools lower the barrier to entry for potential cyberattackers, increasing the choices and volume of threat groups and malicious activities.

In light of this, Cybershield recommends that enterprises pay close attention. The current trend of Ransomware-as-a-Service (RaaS) makes large-scale cyberattacks incredibly easy, and enterprises must be prepared at all times to ensure they can defend against sudden attacks.

The Cybershield simulation attack library now includes relevant attack methods. Search for the keyword "DarkCrystalRat" in the Cybershield Security Measurement and Validation Platform to access relevant attack simulation validation actions, enabling you to verify whether your security defence system can effectively counter such attacks.