Resubmissions

21-04-2021 18:06

210421-67ta5keqaa 10

21-04-2021 18:02

210421-f5gwj58ryj 10

Analysis

  • max time kernel
    330s
  • max time network
    395s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    21-04-2021 18:06

General

  • Target

    dashdV.exe

  • Size

    17.1MB

  • MD5

    765f570a565d578f2ace3ccb41cef038

  • SHA1

    89b44e3aa8f3c93f80ae29f7a36a9486b080229d

  • SHA256

    0d7c515d3483b45d5725717070e8497435c39b3450af59194b2a32a33c2867e8

  • SHA512

    941862a1d09e70725f9826b05dc8a8c7442add91229f39ac7ea9d4e6b8d0f751d749ac6b6ac2202290122945e14bab06516680a7007598af7cca62ac1b465898

Malware Config

Signatures

  • DCrat 2 IoCs

    DarkCrystalrat.

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 12 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dashdV.exe
    "C:\Users\Admin\AppData\Local\Temp\dashdV.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\ProgramData\aye.exe
      "C:\ProgramData\aye.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\D2RrWRv0Po.vbe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\kk946QGUYfip6zCEWvxdUIQltPP.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4036
          • C:\Windows\SysWOW64\netDhcpDriverruntimeCommon.exe
            "C:\Windows\system32\netDhcpDriverruntimeCommon.exe"
            5⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2784
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities\OfficeClickToRun.exe'" /rl HIGHEST /f
              6⤵
              • Creates scheduled task(s)
              PID:632
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\explorer\explorer.exe'" /rl HIGHEST /f
              6⤵
              • Creates scheduled task(s)
              PID:296
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\wininit.exe'" /rl HIGHEST /f
              6⤵
              • Creates scheduled task(s)
              PID:204
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\INETRES\dllhost.exe'" /rl HIGHEST /f
              6⤵
              • Creates scheduled task(s)
              PID:2888
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\BioIso\winlogon.exe'" /rl HIGHEST /f
              6⤵
              • Creates scheduled task(s)
              PID:2280
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\nshhttp\taskhostw.exe'" /rl HIGHEST /f
              6⤵
              • Creates scheduled task(s)
              PID:2072
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Public\LSInqPny0Y.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2076
              • C:\Windows\system32\chcp.com
                chcp 65001
                7⤵
                  PID:3304
                • C:\Windows\system32\PING.EXE
                  ping -n 5 localhost
                  7⤵
                  • Runs ping.exe
                  PID:396
                • C:\Windows\System32\nshhttp\taskhostw.exe
                  "C:\Windows\System32\nshhttp\taskhostw.exe"
                  7⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3956

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Winlogon Helper DLL

    1
    T1004

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Remote System Discovery

    1
    T1018

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\aye.exe
      MD5

      fed9979b059967674138a00a535310e9

      SHA1

      de3001de07bb5f6a19649540512b9d29acb8a7d9

      SHA256

      4a0eda4125af78fee87b855f00379513adaeebf66eedd34ba61af90874eed366

      SHA512

      e1445d4f149594901ee86542856f856a8874ea2caf2076a729d2fea3fe57cdf934d9912882dccb8d4e295035fc836d1d9cf81418973affd2da4d3bc40778345d

    • C:\ProgramData\aye.exe
      MD5

      fed9979b059967674138a00a535310e9

      SHA1

      de3001de07bb5f6a19649540512b9d29acb8a7d9

      SHA256

      4a0eda4125af78fee87b855f00379513adaeebf66eedd34ba61af90874eed366

      SHA512

      e1445d4f149594901ee86542856f856a8874ea2caf2076a729d2fea3fe57cdf934d9912882dccb8d4e295035fc836d1d9cf81418973affd2da4d3bc40778345d

    • C:\Users\Public\LSInqPny0Y.bat
      MD5

      d254391ca40e7726eac85dd50e0038b8

      SHA1

      426d2007e28b1dd8199ebd9cf3df2d919f7c93e6

      SHA256

      4ea3c472506bbb849bb209719e6f8dd473faa8344df2236f465c1397f0493083

      SHA512

      a30aacafa8351cdc60c4bcf684a3efb473645d8e6234e571bee141f55b918d0b543d86967774f8fea4b25905dfb197fe9589d141b13e0099ead78ab84ce283d1

    • C:\Windows\SysWOW64\D2RrWRv0Po.vbe
      MD5

      b57cdbe6bff09c4719cfeeeb11736d47

      SHA1

      040ace85289b8b111e3e44e979a73277bd8284b6

      SHA256

      0d76dd655a3bf305df6382093705ca9a0ec946651fd593c14ce81b0b286c6a5b

      SHA512

      55fc21fcd6c0572c595271fc2a15d7b9eeab6dfd0ad055a498acfeba05a09e0ebc32fe674f985c101c62f6419c2404f314acc8ec5a8744b67971daaaca2b4451

    • C:\Windows\SysWOW64\kk946QGUYfip6zCEWvxdUIQltPP.bat
      MD5

      b95e24d87d79c2b36fc0f8ef4434cfb7

      SHA1

      0e2a2c904e15f7f2e68a89f238d262b1d0b0f2e5

      SHA256

      8fef5c403a59ab01e615e97319fe70c8a3e0234272334cb2d63ffd9f784ee726

      SHA512

      e4cb26aed7aaf65cce7b4ed72c1f2edcf30bd46868d302836b55e976a3762cf6e30f5bf539b1b9b44f300e400fca68f79b6893ab936b8f49921823927c41f46b

    • C:\Windows\SysWOW64\netDhcpDriverruntimeCommon.exe
      MD5

      6e6663ec26bed1a1b0e513aafddff490

      SHA1

      96b6a2c50e4662058799efee8278e1b2252f525b

      SHA256

      a7479ec985fd5c474ef5ee35110c61f10abf40e950f8673405c4f89777f28571

      SHA512

      dd6b62c08cdddc94750eb408c804e76c0e3c14196f18c419025f00958916d9e45fa2a537e15afc59dd291456507e4b61d472cb00e498f12af6936e434a4669af

    • C:\Windows\SysWOW64\netDhcpDriverruntimeCommon.exe
      MD5

      6e6663ec26bed1a1b0e513aafddff490

      SHA1

      96b6a2c50e4662058799efee8278e1b2252f525b

      SHA256

      a7479ec985fd5c474ef5ee35110c61f10abf40e950f8673405c4f89777f28571

      SHA512

      dd6b62c08cdddc94750eb408c804e76c0e3c14196f18c419025f00958916d9e45fa2a537e15afc59dd291456507e4b61d472cb00e498f12af6936e434a4669af

    • C:\Windows\System32\nshhttp\taskhostw.exe
      MD5

      6e6663ec26bed1a1b0e513aafddff490

      SHA1

      96b6a2c50e4662058799efee8278e1b2252f525b

      SHA256

      a7479ec985fd5c474ef5ee35110c61f10abf40e950f8673405c4f89777f28571

      SHA512

      dd6b62c08cdddc94750eb408c804e76c0e3c14196f18c419025f00958916d9e45fa2a537e15afc59dd291456507e4b61d472cb00e498f12af6936e434a4669af

    • C:\Windows\System32\nshhttp\taskhostw.exe
      MD5

      6e6663ec26bed1a1b0e513aafddff490

      SHA1

      96b6a2c50e4662058799efee8278e1b2252f525b

      SHA256

      a7479ec985fd5c474ef5ee35110c61f10abf40e950f8673405c4f89777f28571

      SHA512

      dd6b62c08cdddc94750eb408c804e76c0e3c14196f18c419025f00958916d9e45fa2a537e15afc59dd291456507e4b61d472cb00e498f12af6936e434a4669af

    • memory/204-139-0x0000000000000000-mapping.dmp
    • memory/296-138-0x0000000000000000-mapping.dmp
    • memory/396-146-0x0000000000000000-mapping.dmp
    • memory/632-137-0x0000000000000000-mapping.dmp
    • memory/1748-121-0x0000000000000000-mapping.dmp
    • memory/2072-142-0x0000000000000000-mapping.dmp
    • memory/2076-126-0x0000000000000000-mapping.dmp
    • memory/2076-143-0x0000000000000000-mapping.dmp
    • memory/2280-141-0x0000000000000000-mapping.dmp
    • memory/2784-131-0x0000000000000000-mapping.dmp
    • memory/2784-136-0x000001DF0FB40000-0x000001DF0FB42000-memory.dmp
      Filesize

      8KB

    • memory/2784-134-0x000001DF0F700000-0x000001DF0F701000-memory.dmp
      Filesize

      4KB

    • memory/2888-140-0x0000000000000000-mapping.dmp
    • memory/3152-128-0x0000000004C30000-0x0000000004CC2000-memory.dmp
      Filesize

      584KB

    • memory/3152-117-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
      Filesize

      4KB

    • memory/3152-114-0x0000000000360000-0x0000000000361000-memory.dmp
      Filesize

      4KB

    • memory/3152-120-0x0000000004C30000-0x0000000004CC2000-memory.dmp
      Filesize

      584KB

    • memory/3152-119-0x0000000004C30000-0x0000000004CC2000-memory.dmp
      Filesize

      584KB

    • memory/3152-118-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
      Filesize

      4KB

    • memory/3152-116-0x00000000051E0000-0x00000000051E1000-memory.dmp
      Filesize

      4KB

    • memory/3304-145-0x0000000000000000-mapping.dmp
    • memory/3956-153-0x000002B17AF30000-0x000002B17AF31000-memory.dmp
      Filesize

      4KB

    • memory/3956-157-0x000002B17C750000-0x000002B17C752000-memory.dmp
      Filesize

      8KB

    • memory/3956-152-0x000002B17D0B0000-0x000002B17D0B2000-memory.dmp
      Filesize

      8KB

    • memory/3956-162-0x000002B17D0B4000-0x000002B17D0B5000-memory.dmp
      Filesize

      4KB

    • memory/3956-154-0x000002B17AF10000-0x000002B17AF16000-memory.dmp
      Filesize

      24KB

    • memory/3956-155-0x000002B17C700000-0x000002B17C707000-memory.dmp
      Filesize

      28KB

    • memory/3956-156-0x000002B17AF00000-0x000002B17AF02000-memory.dmp
      Filesize

      8KB

    • memory/3956-147-0x0000000000000000-mapping.dmp
    • memory/3956-158-0x000002B17C760000-0x000002B17C762000-memory.dmp
      Filesize

      8KB

    • memory/3956-159-0x000002B17C770000-0x000002B17C772000-memory.dmp
      Filesize

      8KB

    • memory/3956-160-0x000002B17C8A0000-0x000002B17C8A1000-memory.dmp
      Filesize

      4KB

    • memory/3956-161-0x000002B17D0B2000-0x000002B17D0B4000-memory.dmp
      Filesize

      8KB

    • memory/3956-163-0x000002B17D0B5000-0x000002B17D0B7000-memory.dmp
      Filesize

      8KB

    • memory/3956-164-0x000002B17D0B7000-0x000002B17D0B9000-memory.dmp
      Filesize

      8KB

    • memory/4036-130-0x0000000000000000-mapping.dmp