Analysis
-
max time kernel
51s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
28/12/2022, 09:22
General
-
Target
HEUR-Trojan-Spy.MSIL.Stealer.gen-b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6.exe
-
Size
1.6MB
-
MD5
c2941309c33f19d5c2acc448e838b281
-
SHA1
e929e9425de8df49806780664eec76df479f95b9
-
SHA256
b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6
-
SHA512
3ae53ac29729d7da962de103826b105fa785ab3b306c323abb9001e2ef107c320f37d1b807af608f174bb4786a42b050bd440ecd66b60614df3ae230263882e8
-
SSDEEP
24576:oXGq9fNAehxNnn+MsgnUQ0+vgd9Ulk5R/+VKkccpScpuw72sEeh8Sx8y:FqVNxhxFVKQKHgk5RmVKG7dr
Malware Config
Signatures
-
DcRat 14 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 24 IoCs
-
Drops file in System32 directory 18 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xqixiZ9QWd.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Documents\dwm.exe"C:\ProgramData\Documents\dwm.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\lltdsvc\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\ProgramData\Application Data\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\slui\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\ProgramData\Documents\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\SysWOW64\oobe\es-ES\taskhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Documents and Settings\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\es-ES\WMIADAP.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\ProgramData\Templates\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\ProgramData\Adobe\Updater6\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\WindowsUpdate\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5c2941309c33f19d5c2acc448e838b281
SHA1e929e9425de8df49806780664eec76df479f95b9
SHA256b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6
SHA5123ae53ac29729d7da962de103826b105fa785ab3b306c323abb9001e2ef107c320f37d1b807af608f174bb4786a42b050bd440ecd66b60614df3ae230263882e8
-
Filesize
1.6MB
MD5c2941309c33f19d5c2acc448e838b281
SHA1e929e9425de8df49806780664eec76df479f95b9
SHA256b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6
SHA5123ae53ac29729d7da962de103826b105fa785ab3b306c323abb9001e2ef107c320f37d1b807af608f174bb4786a42b050bd440ecd66b60614df3ae230263882e8
-
Filesize
299B
MD543770e679053bb113c04eba05c62ef94
SHA155265123bc38a0fda6738e532e3734e2ece9f930
SHA256acfb461915c0aea59d196163ce9b7d691f80170fc90446c0ad51fac225b3a469
SHA51241167e49fec735c3a15de56e1bc21c15291a5e28c27b67b2340412272170e06858ff7b6d4dbebfc5633c6d07237cd16bf1afd5e417b2172435707ec0b8b3b520
-
Filesize
7KB
MD57b77fa66f4496fed643ce945ae46b8f8
SHA1cb0ed6fddc801f67205ddf2d5e19580287c5f921
SHA25635504f03a01ec55e3d9411525d7a1e8db43cd9e1db152a808b058bea955dd95b
SHA512d55e889b85840c6f76f5415f799d9e3cc99732f3495a88e5c8c58b0e84eea95cc57852c9c881c4e705d52bce63846fd12424be01e19ba55d39aa262526be0e83
-
Filesize
1.6MB
MD5c2941309c33f19d5c2acc448e838b281
SHA1e929e9425de8df49806780664eec76df479f95b9
SHA256b0a22bc0c510257a80017253fda2699c005a4089e37974ee52f2cf1aaf5103b6
SHA5123ae53ac29729d7da962de103826b105fa785ab3b306c323abb9001e2ef107c320f37d1b807af608f174bb4786a42b050bd440ecd66b60614df3ae230263882e8
-
Filesize
3.0MB
-
Filesize
11.4MB
-
Filesize
8KB
-
Filesize
10.1MB
-
Filesize
12KB
-
Filesize
124KB
-
Filesize
12KB
-
Filesize
3.0MB
-
Filesize
12KB
-
Filesize
124KB
-
Filesize
10.1MB
-
Filesize
12KB
-
Filesize
11.4MB
-
Filesize
124KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
112KB
-
Filesize
124KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
124KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
1.6MB
-
Filesize
124KB
-
Filesize
1.6MB
-
Filesize
124KB