Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
297s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25/09/2022, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe
Resource
win10-20220812-en
General
-
Target
53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe
-
Size
610KB
-
MD5
1813103203337607b90a3a1e82147667
-
SHA1
7b3273e539dd8eb6e5f432bbe760b864c6e39257
-
SHA256
53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0
-
SHA512
738a691218edd74c597a51855fb40e32cdf28ae28b86253076007109b2de89a394c927cf99e3da8cb3e632a81b05d861b93b5f2459a389f36d6390fe56216799
-
SSDEEP
6144:F2baYZtolbaLl36GRWKbSmM41lhMrTVT5Hv3Shd6yPLNfMDgquK96iF1UcFnVOws:FmzaNzUQS5
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
resource yara_rule behavioral2/files/0x000400000001a4df-213.dat dcrat behavioral2/files/0x000400000001a4df-212.dat dcrat behavioral2/memory/3436-216-0x0000000000B90000-0x0000000000C84000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
pid Process 3436 662661963-CF1181JIP3HRtQK7X5p.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ipinfo.io 6 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe 3436 662661963-CF1181JIP3HRtQK7X5p.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3436 662661963-CF1181JIP3HRtQK7X5p.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4324 53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe Token: SeDebugPrivilege 3436 662661963-CF1181JIP3HRtQK7X5p.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4324 wrote to memory of 3436 4324 53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe 66 PID 4324 wrote to memory of 3436 4324 53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe"C:\Users\Admin\AppData\Local\Temp\53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\662661963-CF1181JIP3HRtQK7X5p.exe"C:\Users\Admin\AppData\Local\Temp\662661963-CF1181JIP3HRtQK7X5p.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3436
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
951KB
MD5c0934d15fb14685ee7e2dc49b1e4a542
SHA17f1dd57cb3d8da8c37d42b2de4e1e920272bc3a9
SHA256cbfa467c07aae4e0df550d0f5127896961bfc9fcbe30254b1df913c3bf47be52
SHA512653671dcc20de26d183024786aedb65ae8ffcb0d2132006a09e9f9637ec75e791cafc767a94054c2e8f5157c7c172169d8eb1c45d8ad826b6d626fd6fa9bac4d
-
Filesize
951KB
MD5c0934d15fb14685ee7e2dc49b1e4a542
SHA17f1dd57cb3d8da8c37d42b2de4e1e920272bc3a9
SHA256cbfa467c07aae4e0df550d0f5127896961bfc9fcbe30254b1df913c3bf47be52
SHA512653671dcc20de26d183024786aedb65ae8ffcb0d2132006a09e9f9637ec75e791cafc767a94054c2e8f5157c7c172169d8eb1c45d8ad826b6d626fd6fa9bac4d