Analysis
-
max time kernel
129s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 22:55
Behavioral task
behavioral1
Sample
c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891.exe
Resource
win10v2004-20220901-en
General
-
Target
c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891.exe
-
Size
1.3MB
-
MD5
3bb7660baf9ada31b6d80328f544807f
-
SHA1
619b291181c5b325c350db4ed07bbe28434cb9ac
-
SHA256
c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891
-
SHA512
b63bcbd711f4c168070b6abbf5da1e447afc880873d7ff6cf45095f995af913b7cd229f0f97e0c448b96c83ae066f066e6a309594e1c89f68b17025120ea1841
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4780 1324 schtasks.exe 40 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3908 1324 schtasks.exe 40 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3748 1324 schtasks.exe 40 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 1324 schtasks.exe 40 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4308 1324 schtasks.exe 40 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3728 1324 schtasks.exe 40 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1304 1324 schtasks.exe 40 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4052 1324 schtasks.exe 40 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1636 1324 schtasks.exe 40 -
resource yara_rule behavioral1/files/0x0002000000022dda-137.dat dcrat behavioral1/files/0x0002000000022dda-138.dat dcrat behavioral1/memory/2488-139-0x00000000000B0000-0x00000000001C0000-memory.dmp dcrat behavioral1/files/0x0002000000022ddc-163.dat dcrat behavioral1/files/0x0002000000022ddc-164.dat dcrat -
Executes dropped EXE 2 IoCs
pid Process 2488 DllCommonsvc.exe 1368 RuntimeBroker.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1304 schtasks.exe 1636 schtasks.exe 4780 schtasks.exe 3748 schtasks.exe 2164 schtasks.exe 4308 schtasks.exe 3728 schtasks.exe 3908 schtasks.exe 4052 schtasks.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings DllCommonsvc.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2488 DllCommonsvc.exe 4408 powershell.exe 2828 powershell.exe 4708 powershell.exe 1060 powershell.exe 2828 powershell.exe 4408 powershell.exe 1060 powershell.exe 4708 powershell.exe 1368 RuntimeBroker.exe 1368 RuntimeBroker.exe 1368 RuntimeBroker.exe 1368 RuntimeBroker.exe 1368 RuntimeBroker.exe 1368 RuntimeBroker.exe 1368 RuntimeBroker.exe 1368 RuntimeBroker.exe 1368 RuntimeBroker.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1368 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2488 DllCommonsvc.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe Token: SeDebugPrivilege 4708 powershell.exe Token: SeDebugPrivilege 1060 powershell.exe Token: SeDebugPrivilege 1368 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4376 wrote to memory of 4244 4376 c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891.exe 81 PID 4376 wrote to memory of 4244 4376 c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891.exe 81 PID 4376 wrote to memory of 4244 4376 c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891.exe 81 PID 4244 wrote to memory of 3648 4244 WScript.exe 85 PID 4244 wrote to memory of 3648 4244 WScript.exe 85 PID 4244 wrote to memory of 3648 4244 WScript.exe 85 PID 3648 wrote to memory of 2488 3648 cmd.exe 87 PID 3648 wrote to memory of 2488 3648 cmd.exe 87 PID 2488 wrote to memory of 2828 2488 DllCommonsvc.exe 98 PID 2488 wrote to memory of 2828 2488 DllCommonsvc.exe 98 PID 2488 wrote to memory of 1060 2488 DllCommonsvc.exe 105 PID 2488 wrote to memory of 1060 2488 DllCommonsvc.exe 105 PID 2488 wrote to memory of 4708 2488 DllCommonsvc.exe 99 PID 2488 wrote to memory of 4708 2488 DllCommonsvc.exe 99 PID 2488 wrote to memory of 4408 2488 DllCommonsvc.exe 101 PID 2488 wrote to memory of 4408 2488 DllCommonsvc.exe 101 PID 2488 wrote to memory of 4592 2488 DllCommonsvc.exe 106 PID 2488 wrote to memory of 4592 2488 DllCommonsvc.exe 106 PID 4592 wrote to memory of 2876 4592 cmd.exe 108 PID 4592 wrote to memory of 2876 4592 cmd.exe 108 PID 4592 wrote to memory of 1368 4592 cmd.exe 111 PID 4592 wrote to memory of 1368 4592 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891.exe"C:\Users\Admin\AppData\Local\Temp\c81d899cf0ca50b5f8ffa37e964e2bca5b530fd7bf526af295725352150fb891.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Xt53IWezav.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:2876
-
-
C:\providercommon\RuntimeBroker.exe"C:\providercommon\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\providercommon\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
200B
MD5e743aec95ed87abd917d81c6ecbc60e0
SHA1fda8b0c3bafbd2cf9e4ceeccf41524bc089552c3
SHA256c8799c37c416e39d0a24bd7c108c40927842e5c915840f8c8a4b8bd02d109281
SHA512ab358a330176b5e79330d7689746a0197e0681a4034b51c489ec17e712c7e8ce35b52ed84bc30a4ca09c323b1e42f296b3873eebc80adab1ebbf3dc3d0caad63
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478