Analysis

  • max time kernel
    62s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-11-2020 16:58

General

  • Target

    ForceOp 2.8.7 - By RaiSence.exe

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe
    "C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:672
        • C:\intofont\wincommon.exe
          "C:\intofont\wincommon.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\PerfLogs\dllhost.exe'" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:2368
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\odt\svchost.exe'" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:1084
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\intofont\svchost.exe'" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:3468
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\svchost.exe'" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:3268
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:4024
          • C:\Recovery\WindowsRE\sihost.exe
            "C:\Recovery\WindowsRE\sihost.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3232
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3232 -s 1528
              6⤵
              • Suspicious use of NtCreateProcessExOtherParentProcess
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1628
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\intofont\msg.vbs"
      2⤵
        PID:1032

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\WindowsRE\sihost.exe
    • C:\Recovery\WindowsRE\sihost.exe
    • C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe
    • C:\intofont\MOS
    • C:\intofont\msg.vbs
    • C:\intofont\wincommon.exe
    • C:\intofont\wincommon.exe
    • C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat
    • memory/672-19-0x0000000000000000-mapping.dmp
    • memory/1032-15-0x0000000000000000-mapping.dmp
    • memory/1084-28-0x0000000000000000-mapping.dmp
    • memory/1628-58-0x000001E5E28B0000-0x000001E5E28B1000-memory.dmp
      Filesize

      4KB

    • memory/1628-57-0x000001E5E28B0000-0x000001E5E28B1000-memory.dmp
      Filesize

      4KB

    • memory/1628-40-0x000001E5E1A40000-0x000001E5E1A41000-memory.dmp
      Filesize

      4KB

    • memory/1628-39-0x000001E5E1A40000-0x000001E5E1A41000-memory.dmp
      Filesize

      4KB

    • memory/2164-23-0x00007FFC821F0000-0x00007FFC82BDC000-memory.dmp
      Filesize

      9MB

    • memory/2164-20-0x0000000000000000-mapping.dmp
    • memory/2164-24-0x00000000007D0000-0x00000000007D1000-memory.dmp
      Filesize

      4KB

    • memory/2164-26-0x0000000002A30000-0x0000000002A31000-memory.dmp
      Filesize

      4KB

    • memory/2368-27-0x0000000000000000-mapping.dmp
    • memory/3232-47-0x0000000000000000-mapping.dmp
    • memory/3232-50-0x0000000000000000-mapping.dmp
    • memory/3232-53-0x0000000000000000-mapping.dmp
    • memory/3232-32-0x0000000000000000-mapping.dmp
    • memory/3232-43-0x0000000000000000-mapping.dmp
    • memory/3232-45-0x0000000000000000-mapping.dmp
    • memory/3232-44-0x0000000000000000-mapping.dmp
    • memory/3232-46-0x0000000000000000-mapping.dmp
    • memory/3232-56-0x0000000000000000-mapping.dmp
    • memory/3232-42-0x0000000000000000-mapping.dmp
    • memory/3232-48-0x0000000000000000-mapping.dmp
    • memory/3232-35-0x00007FFC821F0000-0x00007FFC82BDC000-memory.dmp
      Filesize

      9MB

    • memory/3232-49-0x0000000000000000-mapping.dmp
    • memory/3232-51-0x0000000000000000-mapping.dmp
    • memory/3232-52-0x0000000000000000-mapping.dmp
    • memory/3232-54-0x0000000000000000-mapping.dmp
    • memory/3232-55-0x0000000000000000-mapping.dmp
    • memory/3268-30-0x0000000000000000-mapping.dmp
    • memory/3408-1-0x0000000000000000-mapping.dmp
    • memory/3468-29-0x0000000000000000-mapping.dmp
    • memory/4024-31-0x0000000000000000-mapping.dmp