Analysis
-
max time kernel
67s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
28-12-2022 09:20
General
-
Target
HEUR-Backdoor.MSIL.LightStone.gen-e76feaaf3b02c4306a6e107b3ee8239feb6ef9fdd0c34a83d4a309d960288930.exe
-
Size
784KB
-
MD5
07db192d82c606c182770ff5f9b1d600
-
SHA1
69d9cbb97206de1eccc22e3b26eb3e33e6c170c4
-
SHA256
e76feaaf3b02c4306a6e107b3ee8239feb6ef9fdd0c34a83d4a309d960288930
-
SHA512
2cdca5458d86fb3690d20e5f995ed6c508ad3d8237325e2baa504f8f27dd83333a443f537b9797d57741c0b29b590770add23057ef300e4570c24e04650f0d27
-
SSDEEP
12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 6 IoCs
-
DCRat payload 4 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 6 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Drops file in System32 directory 16 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-e76feaaf3b02c4306a6e107b3ee8239feb6ef9fdd0c34a83d4a309d960288930.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-e76feaaf3b02c4306a6e107b3ee8239feb6ef9fdd0c34a83d4a309d960288930.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\unCQjhoToQ.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\PerfLogs\Admin\Idle.exe"C:\PerfLogs\Admin\Idle.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\asferror\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\PerfLogs\Admin\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\fontext\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\C_864\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\ShellNew\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\iscsicpl\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5a791def3b02684523ca23a9c0fef5d71
SHA1bcaf5424318558165cea74a448cb1514e65846a4
SHA2566718b87a9a7127040d448b444b0157d35f315f07ffa9389df7926d89a1b8d3b4
SHA5123a7021bb51262b32d4759f20c2b7e73beb73671ddd7adcf553745f5a11fc79ac78eec275b305957cfc792a4f3af618cfe016bdf7fa6b96cbc780810f7551505a
-
Filesize
784KB
MD5a791def3b02684523ca23a9c0fef5d71
SHA1bcaf5424318558165cea74a448cb1514e65846a4
SHA2566718b87a9a7127040d448b444b0157d35f315f07ffa9389df7926d89a1b8d3b4
SHA5123a7021bb51262b32d4759f20c2b7e73beb73671ddd7adcf553745f5a11fc79ac78eec275b305957cfc792a4f3af618cfe016bdf7fa6b96cbc780810f7551505a
-
Filesize
190B
MD549606e149ea27a692af73e77bb471d96
SHA1066503904503c03567a3fb0176d43013ce30f580
SHA2567c7d154ffa0613f8a045a40a006bc91af74eedd82d6862d2f89e6f25a9613fd8
SHA5123743fe21a1d02a46add2cc32ff754f04d82d61143ac295a56e68f938d93bb4cf897cadccbce5e09efac4f71dc870e4253d2418fb45d916f8f02c35c0e0c9bbee
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
808KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
32KB
-
Filesize
808KB
-
Filesize
40KB
-
Filesize
124KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB