Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2023 18:55
Behavioral task
behavioral1
Sample
CrypterLocalMin.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
CrypterLocalMin.exe
Resource
win10v2004-20221111-en
General
-
Target
CrypterLocalMin.exe
-
Size
627KB
-
MD5
fc938e39c9d9e09ef95d04b7529ff7cf
-
SHA1
c726cefba588cea3135ba7bb47228676d68ce51a
-
SHA256
c01b4811306e46eb5b8bd85e25a5d6c9fdf508983855278e2ad905bcbd4a052d
-
SHA512
0afe99956bc923ccfef67e7e9a854a0f601fc53cfdcbd29964ee2d6f21e33a88f0fa43fbac13c24b25abc433abccb8e54ddab73a460596fb165190f5550915db
-
SSDEEP
12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbdnNE5XM/j7DFJvAmLRFQ5S/RW:U2G/nvxW3Ww0tdnNKMnffLRuiY
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe dcrat C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe dcrat behavioral2/memory/5048-139-0x00000000009F0000-0x0000000000A46000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
comserverweb.exepid process 5048 comserverweb.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CrypterLocalMin.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation CrypterLocalMin.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
CrypterLocalMin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings CrypterLocalMin.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
comserverweb.exepid process 5048 comserverweb.exe 5048 comserverweb.exe 5048 comserverweb.exe 5048 comserverweb.exe 5048 comserverweb.exe 5048 comserverweb.exe 5048 comserverweb.exe 5048 comserverweb.exe 5048 comserverweb.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
comserverweb.exepid process 5048 comserverweb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
comserverweb.exedescription pid process Token: SeDebugPrivilege 5048 comserverweb.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
CrypterLocalMin.exeWScript.execmd.exedescription pid process target process PID 4640 wrote to memory of 4104 4640 CrypterLocalMin.exe WScript.exe PID 4640 wrote to memory of 4104 4640 CrypterLocalMin.exe WScript.exe PID 4640 wrote to memory of 4104 4640 CrypterLocalMin.exe WScript.exe PID 4104 wrote to memory of 4752 4104 WScript.exe cmd.exe PID 4104 wrote to memory of 4752 4104 WScript.exe cmd.exe PID 4104 wrote to memory of 4752 4104 WScript.exe cmd.exe PID 4752 wrote to memory of 5048 4752 cmd.exe comserverweb.exe PID 4752 wrote to memory of 5048 4752 cmd.exe comserverweb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrypterLocalMin.exe"C:\Users\Admin\AppData\Local\Temp\CrypterLocalMin.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\comagentcrt\MindHbkMsqJtnggHhLqJYVFdJogj.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\comagentcrt\0y48fJbU8ZJyCFlP01qjkan2bHzNa9.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe"C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\comagentcrt\0y48fJbU8ZJyCFlP01qjkan2bHzNa9.batFilesize
40B
MD5fa71a847d3db65d16448b0f39dfd3946
SHA1dd692c33c6a9c3430da37287db449d6c2c78d3af
SHA25611698cca37e79638da4080a130849756ce731cbc84ecbbbf0688f163a4c7976a
SHA5126920c7cd9ec449279619b87daa1014c07da36ef2eabdf144fee2ad5788caf2573bd520321e82ad09ad9f1da72959b4ff1ab3f5598b1104093b60b41c5a742680
-
C:\Users\Admin\AppData\Roaming\comagentcrt\MindHbkMsqJtnggHhLqJYVFdJogj.vbeFilesize
225B
MD540917542795e430f04c790b856695465
SHA15bd7bcf32175ff2532f4ae80e7f0fc9b6ebff8ab
SHA256742d5d5790437a511822599e975215723bcedc56f88884c704b9ca35a26ce46b
SHA512f2e13438d7027fb4c15891ea110fd9cfb15e238e5d6d5b6b6e8a06d65342f33eaff3a48187df15dde2752d30634e1aa687302e5cc45e61527b633fc43310256b
-
C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exeFilesize
317KB
MD561ee39f5537e65720ec629a593809c02
SHA1a3ce1a9970fdb69c5f4bde0ffa49ca4cbd0c69bd
SHA2568bed0227175fdad5e7f3c17003af481764230711f774b10af6b55d1ab58b25ec
SHA5122e3c1ae897060820b0d5734c2c74740c22f4d45426fd51917a37cef652917ad12efdda7f3f9352e983f6f029a0d739317630928b82f247d1bbb00685ce97f284
-
C:\Users\Admin\AppData\Roaming\comagentcrt\comserverweb.exeFilesize
317KB
MD561ee39f5537e65720ec629a593809c02
SHA1a3ce1a9970fdb69c5f4bde0ffa49ca4cbd0c69bd
SHA2568bed0227175fdad5e7f3c17003af481764230711f774b10af6b55d1ab58b25ec
SHA5122e3c1ae897060820b0d5734c2c74740c22f4d45426fd51917a37cef652917ad12efdda7f3f9352e983f6f029a0d739317630928b82f247d1bbb00685ce97f284
-
memory/4104-132-0x0000000000000000-mapping.dmp
-
memory/4752-135-0x0000000000000000-mapping.dmp
-
memory/5048-136-0x0000000000000000-mapping.dmp
-
memory/5048-139-0x00000000009F0000-0x0000000000A46000-memory.dmpFilesize
344KB
-
memory/5048-140-0x00007FF8A6940000-0x00007FF8A7401000-memory.dmpFilesize
10.8MB
-
memory/5048-141-0x00007FF8A6940000-0x00007FF8A7401000-memory.dmpFilesize
10.8MB