Analysis
-
max time kernel
301s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
24-11-2022 07:48
General
-
Target
8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe
-
Size
1.1MB
-
MD5
b478d340a787b85e086cc951d0696cb1
-
SHA1
563d9f1b35b4898d16aff1dccd8969299f7ab8b7
-
SHA256
8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95
-
SHA512
93c5a3010ae7bf41ad966902aeaa32e17faa0bad3e76248e2096478af5bf169f817c6914a775efc666967a425716609099be8bf69e2900613a65791e4fcd3e09
-
SSDEEP
24576:npe9a9aC/qF5EZNo9DzDn07bPVICwUmmHcexxnn:pwa9a9F54qH075kUmmHxx1n
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Executes dropped EXE 6 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
NSIS installer 4 IoCs
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 61 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe"C:\Users\Admin\AppData\Local\Temp\8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mnb.exe"C:\Users\Admin\AppData\Local\Temp\mnb.exe" -s -psfghrykjrsetdrfhjryuygs3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fsdffc.exe"C:\Users\Admin\AppData\Roaming\fsdffc.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\dfsds.exe"C:\Users\Admin\AppData\Roaming\dfsds.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\daaca.exe"C:\Users\Admin\AppData\Roaming\daaca.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 1445⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\dal.exe"C:\Users\Admin\AppData\Local\Temp\dal.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4384 -ip 43841⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD569947fc31894cd78ea651768721e26fa
SHA18f1d431dc0e082e29b8e420df9063737c56d6600
SHA2562e16065cb223473d0891696e8bed97c240baad32d66c71a9c35b3f2faa1c02b7
SHA512d1ebb7427a16201f827c918798e9c90a278b936846459f01ad09f4f095989792260cfab243f3a3655db2784a4a979f9badfd57462d0e7aa233f8c7f83a5fd1f0
-
Filesize
35KB
MD569947fc31894cd78ea651768721e26fa
SHA18f1d431dc0e082e29b8e420df9063737c56d6600
SHA2562e16065cb223473d0891696e8bed97c240baad32d66c71a9c35b3f2faa1c02b7
SHA512d1ebb7427a16201f827c918798e9c90a278b936846459f01ad09f4f095989792260cfab243f3a3655db2784a4a979f9badfd57462d0e7aa233f8c7f83a5fd1f0
-
Filesize
1.2MB
MD58d44f882db1ce5ec780096bd698cadeb
SHA15eb4589f28d054befe40750a7c54de8a6f1bd0fa
SHA256103df9101017558d967a8d246739520b7024a930319c3352278c19298ec6084e
SHA512f97ccc467096023d704a4761c253ac73ed9bd3173cf1b7734b3cc6433e53f9e26393b30922c6836349a834ce8293c8b55c742a2be3f89cef42f5d2e8473347e7
-
Filesize
1.2MB
MD58d44f882db1ce5ec780096bd698cadeb
SHA15eb4589f28d054befe40750a7c54de8a6f1bd0fa
SHA256103df9101017558d967a8d246739520b7024a930319c3352278c19298ec6084e
SHA512f97ccc467096023d704a4761c253ac73ed9bd3173cf1b7734b3cc6433e53f9e26393b30922c6836349a834ce8293c8b55c742a2be3f89cef42f5d2e8473347e7
-
Filesize
415KB
MD5dda23435a7b21721ba96ae7fb9812e20
SHA12e179d2f38f04879d249aac505ec05e99efbe6aa
SHA256521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6
SHA512b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce
-
Filesize
415KB
MD5dda23435a7b21721ba96ae7fb9812e20
SHA12e179d2f38f04879d249aac505ec05e99efbe6aa
SHA256521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6
SHA512b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
48KB
MD5f12bdda1f8ea3816740ba7a81df1e92e
SHA17e8f561c66e76868d2145029f71fd6ed8bc3dd50
SHA256d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273
SHA512f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb
-
Filesize
48KB
MD5f12bdda1f8ea3816740ba7a81df1e92e
SHA17e8f561c66e76868d2145029f71fd6ed8bc3dd50
SHA256d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273
SHA512f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
472KB
-
-
Filesize
10.8MB
-
Filesize
120KB
-
Filesize
1.2MB
-
Filesize
10.8MB
-
-
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
104KB
-
Filesize
104KB
-
-
Filesize
440KB
-
Filesize
208KB
-
-