Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
24-11-2022 07:50
General
-
Target
8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe
-
Size
1.1MB
-
MD5
b478d340a787b85e086cc951d0696cb1
-
SHA1
563d9f1b35b4898d16aff1dccd8969299f7ab8b7
-
SHA256
8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95
-
SHA512
93c5a3010ae7bf41ad966902aeaa32e17faa0bad3e76248e2096478af5bf169f817c6914a775efc666967a425716609099be8bf69e2900613a65791e4fcd3e09
-
SSDEEP
24576:npe9a9aC/qF5EZNo9DzDn07bPVICwUmmHcexxnn:pwa9a9F54qH075kUmmHxx1n
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Executes dropped EXE 6 IoCs
-
Drops startup file 2 IoCs
-
Loads dropped DLL 13 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 61 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe"C:\Users\Admin\AppData\Local\Temp\8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mnb.exe"C:\Users\Admin\AppData\Local\Temp\mnb.exe" -s -psfghrykjrsetdrfhjryuygs3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fsdffc.exe"C:\Users\Admin\AppData\Roaming\fsdffc.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\dfsds.exe"C:\Users\Admin\AppData\Roaming\dfsds.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sppsvc.exe"C:\Users\Admin\AppData\Roaming\sppsvc.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\daaca.exe"C:\Users\Admin\AppData\Roaming\daaca.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dal.exe"C:\Users\Admin\AppData\Local\Temp\dal.exe"3⤵
- Executes dropped EXE
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD569947fc31894cd78ea651768721e26fa
SHA18f1d431dc0e082e29b8e420df9063737c56d6600
SHA2562e16065cb223473d0891696e8bed97c240baad32d66c71a9c35b3f2faa1c02b7
SHA512d1ebb7427a16201f827c918798e9c90a278b936846459f01ad09f4f095989792260cfab243f3a3655db2784a4a979f9badfd57462d0e7aa233f8c7f83a5fd1f0
-
Filesize
35KB
MD569947fc31894cd78ea651768721e26fa
SHA18f1d431dc0e082e29b8e420df9063737c56d6600
SHA2562e16065cb223473d0891696e8bed97c240baad32d66c71a9c35b3f2faa1c02b7
SHA512d1ebb7427a16201f827c918798e9c90a278b936846459f01ad09f4f095989792260cfab243f3a3655db2784a4a979f9badfd57462d0e7aa233f8c7f83a5fd1f0
-
Filesize
1.2MB
MD58d44f882db1ce5ec780096bd698cadeb
SHA15eb4589f28d054befe40750a7c54de8a6f1bd0fa
SHA256103df9101017558d967a8d246739520b7024a930319c3352278c19298ec6084e
SHA512f97ccc467096023d704a4761c253ac73ed9bd3173cf1b7734b3cc6433e53f9e26393b30922c6836349a834ce8293c8b55c742a2be3f89cef42f5d2e8473347e7
-
Filesize
1.2MB
MD58d44f882db1ce5ec780096bd698cadeb
SHA15eb4589f28d054befe40750a7c54de8a6f1bd0fa
SHA256103df9101017558d967a8d246739520b7024a930319c3352278c19298ec6084e
SHA512f97ccc467096023d704a4761c253ac73ed9bd3173cf1b7734b3cc6433e53f9e26393b30922c6836349a834ce8293c8b55c742a2be3f89cef42f5d2e8473347e7
-
Filesize
455B
MD51015a3e3736c0688394128483ba16017
SHA1c89eea067facad969ef507ae612508b6cd12bc97
SHA25680ff70c9f15231d1da30560d4aa2efc54301a68c79136f26aaca2138b750e303
SHA51282c780d3874e60acef251bb126c5144993f2fc14e1cfcd200fe269f1235c03b150e20e326db89f92ef369c2a88458356f8bb5444c835ad63c0e0d36bd2adcdcc
-
Filesize
661B
MD5d667d38143a65821a04b6d950ed5fb07
SHA18bfb9ed1a8a32b12f17448c146a9377d18bc95c7
SHA256933bb383a336ca0e95e65cb14ce33d806e8604d08157e13f5faca2319f020619
SHA5123bb34f1c3e4cbe492728aef1f92a3b8ecc0167b11ea22dd0a46ce37c533c86e17114853e8db1c00ddb271d11cd12b8d9e906250f95297407ff7fdaa00a301962
-
Filesize
415KB
MD5dda23435a7b21721ba96ae7fb9812e20
SHA12e179d2f38f04879d249aac505ec05e99efbe6aa
SHA256521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6
SHA512b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce
-
Filesize
415KB
MD5dda23435a7b21721ba96ae7fb9812e20
SHA12e179d2f38f04879d249aac505ec05e99efbe6aa
SHA256521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6
SHA512b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
48KB
MD5f12bdda1f8ea3816740ba7a81df1e92e
SHA17e8f561c66e76868d2145029f71fd6ed8bc3dd50
SHA256d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273
SHA512f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb
-
Filesize
48KB
MD5f12bdda1f8ea3816740ba7a81df1e92e
SHA17e8f561c66e76868d2145029f71fd6ed8bc3dd50
SHA256d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273
SHA512f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
35KB
MD569947fc31894cd78ea651768721e26fa
SHA18f1d431dc0e082e29b8e420df9063737c56d6600
SHA2562e16065cb223473d0891696e8bed97c240baad32d66c71a9c35b3f2faa1c02b7
SHA512d1ebb7427a16201f827c918798e9c90a278b936846459f01ad09f4f095989792260cfab243f3a3655db2784a4a979f9badfd57462d0e7aa233f8c7f83a5fd1f0
-
Filesize
1.2MB
MD58d44f882db1ce5ec780096bd698cadeb
SHA15eb4589f28d054befe40750a7c54de8a6f1bd0fa
SHA256103df9101017558d967a8d246739520b7024a930319c3352278c19298ec6084e
SHA512f97ccc467096023d704a4761c253ac73ed9bd3173cf1b7734b3cc6433e53f9e26393b30922c6836349a834ce8293c8b55c742a2be3f89cef42f5d2e8473347e7
-
Filesize
415KB
MD5dda23435a7b21721ba96ae7fb9812e20
SHA12e179d2f38f04879d249aac505ec05e99efbe6aa
SHA256521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6
SHA512b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce
-
Filesize
415KB
MD5dda23435a7b21721ba96ae7fb9812e20
SHA12e179d2f38f04879d249aac505ec05e99efbe6aa
SHA256521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6
SHA512b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce
-
Filesize
415KB
MD5dda23435a7b21721ba96ae7fb9812e20
SHA12e179d2f38f04879d249aac505ec05e99efbe6aa
SHA256521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6
SHA512b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce
-
Filesize
415KB
MD5dda23435a7b21721ba96ae7fb9812e20
SHA12e179d2f38f04879d249aac505ec05e99efbe6aa
SHA256521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6
SHA512b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
1.2MB
MD5047af34af65efd5c6ee38eb7ad100a01
SHA161809e8f559b27e72a603a45a53116327845dbeb
SHA256931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
SHA5127e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
-
Filesize
48KB
MD5f12bdda1f8ea3816740ba7a81df1e92e
SHA17e8f561c66e76868d2145029f71fd6ed8bc3dd50
SHA256d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273
SHA512f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb
-
Filesize
48KB
MD5f12bdda1f8ea3816740ba7a81df1e92e
SHA17e8f561c66e76868d2145029f71fd6ed8bc3dd50
SHA256d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273
SHA512f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb
-
Filesize
48KB
MD5f12bdda1f8ea3816740ba7a81df1e92e
SHA17e8f561c66e76868d2145029f71fd6ed8bc3dd50
SHA256d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273
SHA512f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
1.3MB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
416KB
-
-
Filesize
8KB
-
Filesize
1.2MB
-
-
-
Filesize
8KB
-
-
-
Filesize
208KB
-
-
Filesize
1.2MB
-