Analysis
-
max time kernel
297s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
25/09/2022, 22:17
General
-
Target
53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe
-
Size
610KB
-
MD5
1813103203337607b90a3a1e82147667
-
SHA1
7b3273e539dd8eb6e5f432bbe760b864c6e39257
-
SHA256
53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0
-
SHA512
738a691218edd74c597a51855fb40e32cdf28ae28b86253076007109b2de89a394c927cf99e3da8cb3e632a81b05d861b93b5f2459a389f36d6390fe56216799
-
SSDEEP
6144:F2baYZtolbaLl36GRWKbSmM41lhMrTVT5Hv3Shd6yPLNfMDgquK96iF1UcFnVOws:FmzaNzUQS5
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
DCRat payload 3 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe"C:\Users\Admin\AppData\Local\Temp\53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\662661963-CF1181JIP3HRtQK7X5p.exe"C:\Users\Admin\AppData\Local\Temp\662661963-CF1181JIP3HRtQK7X5p.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
951KB
MD5c0934d15fb14685ee7e2dc49b1e4a542
SHA17f1dd57cb3d8da8c37d42b2de4e1e920272bc3a9
SHA256cbfa467c07aae4e0df550d0f5127896961bfc9fcbe30254b1df913c3bf47be52
SHA512653671dcc20de26d183024786aedb65ae8ffcb0d2132006a09e9f9637ec75e791cafc767a94054c2e8f5157c7c172169d8eb1c45d8ad826b6d626fd6fa9bac4d
-
Filesize
951KB
MD5c0934d15fb14685ee7e2dc49b1e4a542
SHA17f1dd57cb3d8da8c37d42b2de4e1e920272bc3a9
SHA256cbfa467c07aae4e0df550d0f5127896961bfc9fcbe30254b1df913c3bf47be52
SHA512653671dcc20de26d183024786aedb65ae8ffcb0d2132006a09e9f9637ec75e791cafc767a94054c2e8f5157c7c172169d8eb1c45d8ad826b6d626fd6fa9bac4d
-
Filesize
976KB
-
Filesize
112KB
-
Filesize
1.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
5.1MB
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
320KB
-
Filesize
624KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB