Resubmissions

18-11-2020 14:18

201118-dj27sn3f52 10

18-11-2020 13:42

201118-1arz86e7w6 10

18-11-2020 13:38

201118-n8jh228ctn 10

Analysis

  • max time kernel
    1704s
  • max time network
    1718s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-11-2020 13:42

General

  • Target

    ForceOp 2.8.7 - By RaiSence.bin.exe

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.bin.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3456
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3652
        • C:\intofont\wincommon.exe
          "C:\intofont\wincommon.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2272
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:3740
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Users\Public\Videos\svchost.exe'" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:4080
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Users\Default User\svchost.exe'" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:740
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\svchost.exe'" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:3664
          • C:\Recovery\WindowsRE\svchost.exe
            "C:\Recovery\WindowsRE\svchost.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:496
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 496 -s 1692
              6⤵
              • Suspicious use of NtCreateProcessExOtherParentProcess
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1240
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\intofont\msg.vbs"
      2⤵
        PID:504

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\WindowsRE\svchost.exe
    • C:\Recovery\WindowsRE\svchost.exe
    • C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe
    • C:\intofont\MOS
    • C:\intofont\msg.vbs
    • C:\intofont\wincommon.exe
    • C:\intofont\wincommon.exe
    • C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat
    • memory/496-48-0x0000000000000000-mapping.dmp
    • memory/496-32-0x0000000000000000-mapping.dmp
    • memory/496-51-0x0000000000000000-mapping.dmp
    • memory/496-52-0x0000000000000000-mapping.dmp
    • memory/496-50-0x0000000000000000-mapping.dmp
    • memory/496-49-0x0000000000000000-mapping.dmp
    • memory/496-47-0x0000000000000000-mapping.dmp
    • memory/496-53-0x0000000000000000-mapping.dmp
    • memory/496-55-0x0000000000000000-mapping.dmp
    • memory/496-45-0x0000000000000000-mapping.dmp
    • memory/496-54-0x0000000000000000-mapping.dmp
    • memory/496-44-0x0000000000000000-mapping.dmp
    • memory/496-35-0x00007FF9E9F90000-0x00007FF9EA97C000-memory.dmp
      Filesize

      9.9MB

    • memory/496-46-0x0000000000000000-mapping.dmp
    • memory/496-40-0x0000000000000000-mapping.dmp
    • memory/496-41-0x0000000000000000-mapping.dmp
    • memory/496-42-0x0000000000000000-mapping.dmp
    • memory/496-43-0x0000000000000000-mapping.dmp
    • memory/504-15-0x0000000000000000-mapping.dmp
    • memory/740-30-0x0000000000000000-mapping.dmp
    • memory/1240-39-0x000001E44ECB0000-0x000001E44ECB1000-memory.dmp
      Filesize

      4KB

    • memory/1240-56-0x000001E44FA20000-0x000001E44FA21000-memory.dmp
      Filesize

      4KB

    • memory/1240-57-0x000001E44FA20000-0x000001E44FA21000-memory.dmp
      Filesize

      4KB

    • memory/2272-21-0x0000000000000000-mapping.dmp
    • memory/2272-27-0x000000001AC40000-0x000000001AC41000-memory.dmp
      Filesize

      4KB

    • memory/2272-25-0x00000000000B0000-0x00000000000B1000-memory.dmp
      Filesize

      4KB

    • memory/2272-24-0x00007FF9E9F90000-0x00007FF9EA97C000-memory.dmp
      Filesize

      9.9MB

    • memory/3456-2-0x0000000000000000-mapping.dmp
    • memory/3652-20-0x0000000000000000-mapping.dmp
    • memory/3664-31-0x0000000000000000-mapping.dmp
    • memory/3740-28-0x0000000000000000-mapping.dmp
    • memory/4080-29-0x0000000000000000-mapping.dmp