Analysis
- max time kernel
150s - max time network
182s - platform
windows7_x64 - resource
win7v20210408 - submitted
29/07/2021, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
cc982bb10719da0325bdd790df6b3a03.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cc982bb10719da0325bdd790df6b3a03.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target cc982bb10719da0325bdd790df6b3a03.exe
- Size 710KB
- Sample210729-ex2e7w641x
- SHA256 23b110e0a381abb4d44bd7e2906548429ee426d9463a02af31dc3dd98c044341
- MD5 cc982bb10719da0325bdd790df6b3a03
- SHA1 50e130f64cea1540aedc89b8f2a3b89098251899
- SHA512 d7cee94bed439d0aa4ad710aa40b19987af25f1bc986b1b07b9412989d2402d6cf9dafc40c3b2d3fc3f7f9308c4513969643974b0cefb6c083f162c4d6a385b1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\more\\csrss.exe\", \"C:\\Windows\\System32\\msscntrs\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Idle.exe\", \"C:\\Windows\\System32\\Display\\lsm.exe\", \"C:\\Windows\\System32\\ssText3d\\services.exe\", \"C:\\Windows\\winhlp32\\explorer.exe\", \"C:\\Windows\\DtcInstall\\explorer.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\more\\csrss.exe\", \"C:\\Windows\\System32\\msscntrs\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Idle.exe\", \"C:\\Windows\\System32\\Display\\lsm.exe\", \"C:\\Windows\\System32\\ssText3d\\services.exe\", \"C:\\Windows\\winhlp32\\explorer.exe\", \"C:\\Windows\\DtcInstall\\explorer.exe\", \"C:\\Windows\\System32\\wbem\\dot3\\WmiPrvSE.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\more\\csrss.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\more\\csrss.exe\", \"C:\\Windows\\System32\\msscntrs\\spoolsv.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\more\\csrss.exe\", \"C:\\Windows\\System32\\msscntrs\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Idle.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\more\\csrss.exe\", \"C:\\Windows\\System32\\msscntrs\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Idle.exe\", \"C:\\Windows\\System32\\Display\\lsm.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\more\\csrss.exe\", \"C:\\Windows\\System32\\msscntrs\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Idle.exe\", \"C:\\Windows\\System32\\Display\\lsm.exe\", \"C:\\Windows\\System32\\ssText3d\\services.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\more\\csrss.exe\", \"C:\\Windows\\System32\\msscntrs\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Idle.exe\", \"C:\\Windows\\System32\\Display\\lsm.exe\", \"C:\\Windows\\System32\\ssText3d\\services.exe\", \"C:\\Windows\\winhlp32\\explorer.exe\"" cc982bb10719da0325bdd790df6b3a03.exe - Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1616 1436 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 1436 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 668 1436 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 768 1436 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 736 1436 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 856 1436 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1488 1436 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1084 1436 schtasks.exe 29 -
resource yara_rule behavioral1/files/0x00030000000130d3-66.dat dcrat behavioral1/files/0x00030000000130d3-68.dat dcrat - Executes dropped EXE 1 IoCs
pid Process 612 spoolsv.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\more\\csrss.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\DtcInstall\\explorer.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\msscntrs\\spoolsv.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Idle.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\winhlp32\\explorer.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\dot3\\WmiPrvSE.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\dot3\\WmiPrvSE.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\more\\csrss.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Idle.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\Display\\lsm.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\msscntrs\\spoolsv.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\Display\\lsm.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\System32\\ssText3d\\services.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\System32\\ssText3d\\services.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\winhlp32\\explorer.exe\"" cc982bb10719da0325bdd790df6b3a03.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\DtcInstall\\explorer.exe\"" cc982bb10719da0325bdd790df6b3a03.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ipinfo.io 8 ipinfo.io - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\System32\wbem\dot3\24dbde2999530ef5fd907494bc374d663924116c cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\System32\more\csrss.exe cc982bb10719da0325bdd790df6b3a03.exe File opened for modification C:\Windows\System32\more\csrss.exe cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\System32\more\886983d96e3d3e31032c679b2d4ea91b6c05afef cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\System32\msscntrs\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4 cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\System32\ssText3d\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\System32\wbem\dot3\WmiPrvSE.exe cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\System32\msscntrs\spoolsv.exe cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\System32\Display\lsm.exe cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\System32\Display\101b941d020240259ca4912829b53995ad543df6 cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\System32\ssText3d\services.exe cc982bb10719da0325bdd790df6b3a03.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Idle.exe cc982bb10719da0325bdd790df6b3a03.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\6ccacd8608530fba3a93e87ae2225c7032aa18c1 cc982bb10719da0325bdd790df6b3a03.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\winhlp32\explorer.exe cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\winhlp32\7a0fd90576e08807bde2cc57bcf9854bbce05fe3 cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\DtcInstall\explorer.exe cc982bb10719da0325bdd790df6b3a03.exe File created C:\Windows\DtcInstall\7a0fd90576e08807bde2cc57bcf9854bbce05fe3 cc982bb10719da0325bdd790df6b3a03.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1084 schtasks.exe 1616 schtasks.exe 1588 schtasks.exe 668 schtasks.exe 768 schtasks.exe 736 schtasks.exe 856 schtasks.exe 1488 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1796 cc982bb10719da0325bdd790df6b3a03.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 612 spoolsv.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1796 cc982bb10719da0325bdd790df6b3a03.exe Token: SeDebugPrivilege 612 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1796 wrote to memory of 1768 1796 cc982bb10719da0325bdd790df6b3a03.exe 38 PID 1796 wrote to memory of 1768 1796 cc982bb10719da0325bdd790df6b3a03.exe 38 PID 1796 wrote to memory of 1768 1796 cc982bb10719da0325bdd790df6b3a03.exe 38 PID 1768 wrote to memory of 812 1768 cmd.exe 40 PID 1768 wrote to memory of 812 1768 cmd.exe 40 PID 1768 wrote to memory of 812 1768 cmd.exe 40 PID 1768 wrote to memory of 1500 1768 cmd.exe 41 PID 1768 wrote to memory of 1500 1768 cmd.exe 41 PID 1768 wrote to memory of 1500 1768 cmd.exe 41 PID 1768 wrote to memory of 612 1768 cmd.exe 42 PID 1768 wrote to memory of 612 1768 cmd.exe 42 PID 1768 wrote to memory of 612 1768 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc982bb10719da0325bdd790df6b3a03.exe"C:\Users\Admin\AppData\Local\Temp\cc982bb10719da0325bdd790df6b3a03.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MRVLBQPUe9.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:812
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:1500
-
-
C:\Windows\System32\msscntrs\spoolsv.exe"C:\Windows\System32\msscntrs\spoolsv.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:612
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\more\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\msscntrs\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\Display\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\ssText3d\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\winhlp32\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\DtcInstall\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\dot3\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084