Analysis
- max time kernel
92s - max time network
129s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:48
General
- Target 70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe
- Size 3.6MB
- Sample201109-drzbrnmdes
- SHA256 70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- ServiceHost packer 40 IoCs
Detects ServiceHost packer used for .NET malware
- Executes dropped EXE 3 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops startup file 2 IoCs
- Drops file in Windows directory 1 IoCs
- Program crash 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe"C:\Users\Admin\AppData\Local\Temp\70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\8iIALM2eDvdOyvBKy\DCRatBuild.exe"C:\Users\Admin\AppData\Roaming\8iIALM2eDvdOyvBKy\DCRatBuild.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\runtimeperf\System.vbe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\runtimeperf\o4a71YPn3Qcr4qazAb6KaqQivTzcYG.bat" "4⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\runtimeperf\reviewinto.exe"C:\runtimeperf\reviewinto.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1252 -s 14326⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\8iIALM2eDvdOyvBKy\Netflixer v1.0.exe"C:\Users\Admin\AppData\Roaming\8iIALM2eDvdOyvBKy\Netflixer v1.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 11363⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/816-27-0x00000000086A0000-0x00000000086A1000-memory.dmp
memory/816-6-0x00000000735D0000-0x0000000073CBE000-memory.dmp
memory/816-26-0x0000000000750000-0x0000000000751000-memory.dmp
memory/816-31-0x0000000000CD0000-0x0000000000CE0000-memory.dmp
memory/816-25-0x0000000000960000-0x0000000000980000-memory.dmp
memory/816-9-0x0000000000400000-0x0000000000402000-memory.dmp
memory/1252-103-0x000001F837C00000-0x000001F837F4E000-memory.dmp
memory/1252-93-0x00007FF9E6DE0000-0x00007FF9E77CC000-memory.dmp
memory/1252-109-0x000001F837910000-0x000001F83799D000-memory.dmp
memory/1252-111-0x000001F8379B0000-0x000001F8379BF000-memory.dmp
memory/1252-114-0x000001F837A50000-0x000001F837AC5000-memory.dmp
memory/1252-105-0x000001F81D890000-0x000001F81D8DD000-memory.dmp
memory/1252-94-0x000001F81D340000-0x000001F81D341000-memory.dmp
memory/1696-134-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-137-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-139-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-140-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-141-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-142-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-143-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-144-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-145-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-147-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-146-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-148-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-149-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-150-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-151-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-152-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-153-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-154-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-155-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-156-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-157-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-158-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-159-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-160-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-161-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-162-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-32-0x0000000004690000-0x0000000004691000-memory.dmp
memory/1696-33-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/1696-138-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-136-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-135-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-133-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-132-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-131-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-130-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-129-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-128-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-127-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-126-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-125-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-124-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-123-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-108-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-122-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-121-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-120-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-119-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-110-0x0000000005000000-0x0000000005001000-memory.dmp
memory/1696-113-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-118-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-116-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-115-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1696-112-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/2872-182-0x000001407A620000-0x000001407A621000-memory.dmp
memory/2872-166-0x00000140795B0000-0x00000140795B1000-memory.dmp
memory/2872-165-0x00000140795B0000-0x00000140795B1000-memory.dmp
memory/2872-199-0x000001407A710000-0x000001407A711000-memory.dmp