Analysis
-
max time kernel
128s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 22:56
Behavioral task
behavioral1
Sample
9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745.exe
Resource
win10v2004-20220812-en
General
-
Target
9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745.exe
-
Size
1.3MB
-
MD5
61da44a997c52ab4e3cb1388414f7527
-
SHA1
c833ddae9ac47db3351ac3bd28962762e6b239bb
-
SHA256
9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745
-
SHA512
7142215a9263895275a6971bd0eb47b034fbfc7fcd12130b98c57fb19ab33f2000e95c24e2519d3c2e9d39a5c6780782d687b6960653789b058011ebbfe74b72
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5092 4144 schtasks.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1248 4144 schtasks.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3372 4144 schtasks.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4008 4144 schtasks.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3552 4144 schtasks.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 812 4144 schtasks.exe 50 -
resource yara_rule behavioral1/files/0x0006000000022f72-137.dat dcrat behavioral1/files/0x0006000000022f72-138.dat dcrat behavioral1/memory/112-139-0x0000000000A00000-0x0000000000B10000-memory.dmp dcrat behavioral1/files/0x0006000000022f76-146.dat dcrat behavioral1/files/0x0006000000022f76-147.dat dcrat -
Executes dropped EXE 2 IoCs
pid Process 112 DllCommonsvc.exe 2064 smss.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4008 schtasks.exe 3552 schtasks.exe 812 schtasks.exe 5092 schtasks.exe 1248 schtasks.exe 3372 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 112 DllCommonsvc.exe 1880 powershell.exe 2800 powershell.exe 3964 powershell.exe 3964 powershell.exe 1880 powershell.exe 2064 smss.exe 2800 powershell.exe 2064 smss.exe 2064 smss.exe 2064 smss.exe 2064 smss.exe 2064 smss.exe 2064 smss.exe 2064 smss.exe 2064 smss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2064 smss.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 112 DllCommonsvc.exe Token: SeDebugPrivilege 1880 powershell.exe Token: SeDebugPrivilege 3964 powershell.exe Token: SeDebugPrivilege 2800 powershell.exe Token: SeDebugPrivilege 2064 smss.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1516 2440 9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745.exe 79 PID 2440 wrote to memory of 1516 2440 9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745.exe 79 PID 2440 wrote to memory of 1516 2440 9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745.exe 79 PID 1516 wrote to memory of 2552 1516 WScript.exe 83 PID 1516 wrote to memory of 2552 1516 WScript.exe 83 PID 1516 wrote to memory of 2552 1516 WScript.exe 83 PID 2552 wrote to memory of 112 2552 cmd.exe 85 PID 2552 wrote to memory of 112 2552 cmd.exe 85 PID 112 wrote to memory of 2800 112 DllCommonsvc.exe 93 PID 112 wrote to memory of 2800 112 DllCommonsvc.exe 93 PID 112 wrote to memory of 1880 112 DllCommonsvc.exe 94 PID 112 wrote to memory of 1880 112 DllCommonsvc.exe 94 PID 112 wrote to memory of 3964 112 DllCommonsvc.exe 95 PID 112 wrote to memory of 3964 112 DllCommonsvc.exe 95 PID 112 wrote to memory of 2064 112 DllCommonsvc.exe 99 PID 112 wrote to memory of 2064 112 DllCommonsvc.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745.exe"C:\Users\Admin\AppData\Local\Temp\9a4c61c30d19e6f8a0f446d7207516b7a1597cccc6ef298f8ecf3fd8d67fe745.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\smss.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
C:\odt\smss.exe"C:\odt\smss.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\odt\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478