Analysis

  • max time kernel
    54s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    11-01-2021 21:54

General

  • Target

    dllservices.exe

  • Size

    448KB

  • MD5

    eff1b26ff5763d25e892761a02dd2e7c

  • SHA1

    17b677b9f58b54508324da8ab15bc67c66f5f55e

  • SHA256

    ada0493109fcfa84a332ad136f04a96ca7eadc323b57cdce2e6fe3066c37321e

  • SHA512

    53f0e1448ead9098a8efba367c32c1d3f7db09362eba7a62a409cde55d9876e3271dd55017abbdecfbf2abd2da393a5e7ba69bcd065f613d7010e259d43e9721

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DC Rat Payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dllservices.exe
    "C:\Users\Admin\AppData\Local\Temp\dllservices.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Documents and Settings\WmiPrvSE.exe'" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:1580
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\PerfLogs\Admin\WMIADAP.exe'" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:556
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:1464
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\9f428062-1991-11eb-b2ba-ee401b9e63cb\csrss.exe'" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:1940
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\winlogon.exe'" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:1052
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\spoolsv.exe'" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:920
    • C:\Program Files (x86)\WindowsPowerShell\Modules\spoolsv.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1660

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\WindowsPowerShell\Modules\spoolsv.exe
    MD5

    eff1b26ff5763d25e892761a02dd2e7c

    SHA1

    17b677b9f58b54508324da8ab15bc67c66f5f55e

    SHA256

    ada0493109fcfa84a332ad136f04a96ca7eadc323b57cdce2e6fe3066c37321e

    SHA512

    53f0e1448ead9098a8efba367c32c1d3f7db09362eba7a62a409cde55d9876e3271dd55017abbdecfbf2abd2da393a5e7ba69bcd065f613d7010e259d43e9721

  • C:\Program Files (x86)\WindowsPowerShell\Modules\spoolsv.exe
    MD5

    eff1b26ff5763d25e892761a02dd2e7c

    SHA1

    17b677b9f58b54508324da8ab15bc67c66f5f55e

    SHA256

    ada0493109fcfa84a332ad136f04a96ca7eadc323b57cdce2e6fe3066c37321e

    SHA512

    53f0e1448ead9098a8efba367c32c1d3f7db09362eba7a62a409cde55d9876e3271dd55017abbdecfbf2abd2da393a5e7ba69bcd065f613d7010e259d43e9721

  • memory/556-6-0x0000000000000000-mapping.dmp
  • memory/848-2-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp
    Filesize

    9.9MB

  • memory/848-3-0x0000000000370000-0x0000000000371000-memory.dmp
    Filesize

    4KB

  • memory/920-10-0x0000000000000000-mapping.dmp
  • memory/1052-9-0x0000000000000000-mapping.dmp
  • memory/1464-7-0x0000000000000000-mapping.dmp
  • memory/1580-5-0x0000000000000000-mapping.dmp
  • memory/1660-11-0x0000000000000000-mapping.dmp
  • memory/1660-14-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp
    Filesize

    9.9MB

  • memory/1660-15-0x0000000000B50000-0x0000000000B51000-memory.dmp
    Filesize

    4KB

  • memory/1940-8-0x0000000000000000-mapping.dmp