Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21-01-2023 18:55
Behavioral task
behavioral1
Sample
CrypterLocalMin.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
CrypterLocalMin.exe
Resource
win10v2004-20221111-en
General
-
Target
CrypterLocalMin.exe
-
Size
627KB
-
MD5
fc938e39c9d9e09ef95d04b7529ff7cf
-
SHA1
c726cefba588cea3135ba7bb47228676d68ce51a
-
SHA256
c01b4811306e46eb5b8bd85e25a5d6c9fdf508983855278e2ad905bcbd4a052d
-
SHA512
0afe99956bc923ccfef67e7e9a854a0f601fc53cfdcbd29964ee2d6f21e33a88f0fa43fbac13c24b25abc433abccb8e54ddab73a460596fb165190f5550915db
-
SSDEEP
12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbdnNE5XM/j7DFJvAmLRFQ5S/RW:U2G/nvxW3Ww0tdnNKMnffLRuiY
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe dcrat \Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe dcrat C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe dcrat C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe dcrat behavioral1/memory/1368-65-0x0000000000B50000-0x0000000000BA6000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
comserverweb.exepid process 1368 comserverweb.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 472 cmd.exe 472 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
comserverweb.exepid process 1368 comserverweb.exe 1368 comserverweb.exe 1368 comserverweb.exe 1368 comserverweb.exe 1368 comserverweb.exe 1368 comserverweb.exe 1368 comserverweb.exe 1368 comserverweb.exe 1368 comserverweb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
comserverweb.exedescription pid process Token: SeDebugPrivilege 1368 comserverweb.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
CrypterLocalMin.exeWScript.execmd.exedescription pid process target process PID 2036 wrote to memory of 268 2036 CrypterLocalMin.exe WScript.exe PID 2036 wrote to memory of 268 2036 CrypterLocalMin.exe WScript.exe PID 2036 wrote to memory of 268 2036 CrypterLocalMin.exe WScript.exe PID 2036 wrote to memory of 268 2036 CrypterLocalMin.exe WScript.exe PID 268 wrote to memory of 472 268 WScript.exe cmd.exe PID 268 wrote to memory of 472 268 WScript.exe cmd.exe PID 268 wrote to memory of 472 268 WScript.exe cmd.exe PID 268 wrote to memory of 472 268 WScript.exe cmd.exe PID 472 wrote to memory of 1368 472 cmd.exe comserverweb.exe PID 472 wrote to memory of 1368 472 cmd.exe comserverweb.exe PID 472 wrote to memory of 1368 472 cmd.exe comserverweb.exe PID 472 wrote to memory of 1368 472 cmd.exe comserverweb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrypterLocalMin.exe"C:\Users\Admin\AppData\Local\Temp\CrypterLocalMin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\comagentcrt\MindHbkMsqJtnggHhLqJYVFdJogj.vbe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\comagentcrt\0y48fJbU8ZJyCFlP01qjkan2bHzNa9.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe"C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\comagentcrt\0y48fJbU8ZJyCFlP01qjkan2bHzNa9.batFilesize
40B
MD5fa71a847d3db65d16448b0f39dfd3946
SHA1dd692c33c6a9c3430da37287db449d6c2c78d3af
SHA25611698cca37e79638da4080a130849756ce731cbc84ecbbbf0688f163a4c7976a
SHA5126920c7cd9ec449279619b87daa1014c07da36ef2eabdf144fee2ad5788caf2573bd520321e82ad09ad9f1da72959b4ff1ab3f5598b1104093b60b41c5a742680
-
C:\Users\Admin\AppData\Roaming\comagentcrt\MindHbkMsqJtnggHhLqJYVFdJogj.vbeFilesize
225B
MD540917542795e430f04c790b856695465
SHA15bd7bcf32175ff2532f4ae80e7f0fc9b6ebff8ab
SHA256742d5d5790437a511822599e975215723bcedc56f88884c704b9ca35a26ce46b
SHA512f2e13438d7027fb4c15891ea110fd9cfb15e238e5d6d5b6b6e8a06d65342f33eaff3a48187df15dde2752d30634e1aa687302e5cc45e61527b633fc43310256b
-
C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exeFilesize
317KB
MD561ee39f5537e65720ec629a593809c02
SHA1a3ce1a9970fdb69c5f4bde0ffa49ca4cbd0c69bd
SHA2568bed0227175fdad5e7f3c17003af481764230711f774b10af6b55d1ab58b25ec
SHA5122e3c1ae897060820b0d5734c2c74740c22f4d45426fd51917a37cef652917ad12efdda7f3f9352e983f6f029a0d739317630928b82f247d1bbb00685ce97f284
-
C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exeFilesize
317KB
MD561ee39f5537e65720ec629a593809c02
SHA1a3ce1a9970fdb69c5f4bde0ffa49ca4cbd0c69bd
SHA2568bed0227175fdad5e7f3c17003af481764230711f774b10af6b55d1ab58b25ec
SHA5122e3c1ae897060820b0d5734c2c74740c22f4d45426fd51917a37cef652917ad12efdda7f3f9352e983f6f029a0d739317630928b82f247d1bbb00685ce97f284
-
\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exeFilesize
317KB
MD561ee39f5537e65720ec629a593809c02
SHA1a3ce1a9970fdb69c5f4bde0ffa49ca4cbd0c69bd
SHA2568bed0227175fdad5e7f3c17003af481764230711f774b10af6b55d1ab58b25ec
SHA5122e3c1ae897060820b0d5734c2c74740c22f4d45426fd51917a37cef652917ad12efdda7f3f9352e983f6f029a0d739317630928b82f247d1bbb00685ce97f284
-
\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exeFilesize
317KB
MD561ee39f5537e65720ec629a593809c02
SHA1a3ce1a9970fdb69c5f4bde0ffa49ca4cbd0c69bd
SHA2568bed0227175fdad5e7f3c17003af481764230711f774b10af6b55d1ab58b25ec
SHA5122e3c1ae897060820b0d5734c2c74740c22f4d45426fd51917a37cef652917ad12efdda7f3f9352e983f6f029a0d739317630928b82f247d1bbb00685ce97f284
-
memory/268-55-0x0000000000000000-mapping.dmp
-
memory/472-59-0x0000000000000000-mapping.dmp
-
memory/1368-63-0x0000000000000000-mapping.dmp
-
memory/1368-65-0x0000000000B50000-0x0000000000BA6000-memory.dmpFilesize
344KB
-
memory/2036-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB