Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2023 14:29

General

  • Target

    Скриншот.scr

  • Size

    2.0MB

  • MD5

    4130cc053051c6d837a67570ee0b014e

  • SHA1

    0c589bfb09418dc835800d785e025866921325e0

  • SHA256

    deccb4702668020e6bfc1429fe610de599a4385667e5ff2779917f49fc867ed2

  • SHA512

    d18bf297ea60dc4c082a420f74302dc17306ae3ab509bc0f0c38b3691867f41563045b7faed1972efb82738d5b5f02e056574136e3de29a866e6dcde7544621d

  • SSDEEP

    49152:1bA3gTuxSrTiMusYHYm07yKo4fl8ykl+jELqdFVdhhr:1biwiMs07yK1li+jwqX/hh

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Скриншот.scr
    "C:\Users\Admin\AppData\Local\Temp\Скриншот.scr" /S
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1736
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
        work.exe -priverdD
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:844
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1104
  • C:\Windows\system32\SndVol.exe
    SndVol.exe -f 45614235 1390
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1972
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RestartComplete.htm
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
    Filesize

    35B

    MD5

    ff59d999beb970447667695ce3273f75

    SHA1

    316fa09f467ba90ac34a054daf2e92e6e2854ff8

    SHA256

    065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

    SHA512

    d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    Filesize

    1.8MB

    MD5

    eae58983f5eb271fd26d9842fd3a561a

    SHA1

    f3829c26b62189a953d3e753e5efbdb5d53e3aa2

    SHA256

    ce6670936155b4d7f8324d73711d15a028fee6f9b7c6f4262621188acf45382b

    SHA512

    5f5e2a2d369de07aa056f36c55e0daf633b3cec77a3bbbe7fe4eacb64ecfff0dd0f658076b6f6045e8edca63b5268349c871a194cb50fd242afabeb61da0eb0b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    Filesize

    1.8MB

    MD5

    eae58983f5eb271fd26d9842fd3a561a

    SHA1

    f3829c26b62189a953d3e753e5efbdb5d53e3aa2

    SHA256

    ce6670936155b4d7f8324d73711d15a028fee6f9b7c6f4262621188acf45382b

    SHA512

    5f5e2a2d369de07aa056f36c55e0daf633b3cec77a3bbbe7fe4eacb64ecfff0dd0f658076b6f6045e8edca63b5268349c871a194cb50fd242afabeb61da0eb0b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
    Filesize

    1.4MB

    MD5

    a2b5b06c6892da9d79036b2ac472cbcb

    SHA1

    a9975118721d3189dc518740517c577bdcaadf06

    SHA256

    e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

    SHA512

    3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

  • \??\c:\users\admin\appdata\local\temp\rarsfx1\dfesa.exe
    Filesize

    1.4MB

    MD5

    a2b5b06c6892da9d79036b2ac472cbcb

    SHA1

    a9975118721d3189dc518740517c577bdcaadf06

    SHA256

    e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

    SHA512

    3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

  • \Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    Filesize

    1.8MB

    MD5

    eae58983f5eb271fd26d9842fd3a561a

    SHA1

    f3829c26b62189a953d3e753e5efbdb5d53e3aa2

    SHA256

    ce6670936155b4d7f8324d73711d15a028fee6f9b7c6f4262621188acf45382b

    SHA512

    5f5e2a2d369de07aa056f36c55e0daf633b3cec77a3bbbe7fe4eacb64ecfff0dd0f658076b6f6045e8edca63b5268349c871a194cb50fd242afabeb61da0eb0b

  • \Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
    Filesize

    1.4MB

    MD5

    a2b5b06c6892da9d79036b2ac472cbcb

    SHA1

    a9975118721d3189dc518740517c577bdcaadf06

    SHA256

    e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

    SHA512

    3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

  • \Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
    Filesize

    1.4MB

    MD5

    a2b5b06c6892da9d79036b2ac472cbcb

    SHA1

    a9975118721d3189dc518740517c577bdcaadf06

    SHA256

    e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

    SHA512

    3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

  • \Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
    Filesize

    1.4MB

    MD5

    a2b5b06c6892da9d79036b2ac472cbcb

    SHA1

    a9975118721d3189dc518740517c577bdcaadf06

    SHA256

    e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

    SHA512

    3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

  • \Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
    Filesize

    1.4MB

    MD5

    a2b5b06c6892da9d79036b2ac472cbcb

    SHA1

    a9975118721d3189dc518740517c577bdcaadf06

    SHA256

    e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

    SHA512

    3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

  • \Users\Admin\AppData\Local\Temp\RarSFX1\dfesa.exe
    Filesize

    1.4MB

    MD5

    a2b5b06c6892da9d79036b2ac472cbcb

    SHA1

    a9975118721d3189dc518740517c577bdcaadf06

    SHA256

    e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19

    SHA512

    3ee0e6fb6b1ff3443d4ff5b9544b93d942c28dd4b6fffd301806a68e4a7f5d99e7a1aef0c149c830b5ead7adca5c6f777bccf51e9d554c23c26128694dc97f26

  • memory/844-74-0x0000000003620000-0x0000000003A42000-memory.dmp
    Filesize

    4.1MB

  • memory/844-59-0x0000000000000000-mapping.dmp
  • memory/844-72-0x0000000003620000-0x0000000003A42000-memory.dmp
    Filesize

    4.1MB

  • memory/844-73-0x0000000003620000-0x0000000003A42000-memory.dmp
    Filesize

    4.1MB

  • memory/1104-67-0x0000000000000000-mapping.dmp
  • memory/1104-71-0x0000000000110000-0x0000000000532000-memory.dmp
    Filesize

    4.1MB

  • memory/1104-75-0x0000000000110000-0x0000000000532000-memory.dmp
    Filesize

    4.1MB

  • memory/1104-76-0x0000000002270000-0x000000000228C000-memory.dmp
    Filesize

    112KB

  • memory/1104-77-0x00000000023E0000-0x00000000023F6000-memory.dmp
    Filesize

    88KB

  • memory/1104-78-0x0000000002580000-0x0000000002592000-memory.dmp
    Filesize

    72KB

  • memory/1732-54-0x0000000075E81000-0x0000000075E83000-memory.dmp
    Filesize

    8KB

  • memory/1736-55-0x0000000000000000-mapping.dmp
  • memory/1972-79-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp
    Filesize

    8KB