Analysis
-
max time kernel
133s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 22:00
Behavioral task
behavioral1
Sample
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe
Resource
win10v2004-20220812-en
General
-
Target
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe
-
Size
4.6MB
-
MD5
43334042325d6a1a3ae84729cb8b5cb0
-
SHA1
a1552e1c54b9024db5b75df401f76e510086c80e
-
SHA256
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e
-
SHA512
c08e24a7197af85f0446404ba0531cd81d313712b2f83e394b498bc842604f15b181bc93d8220959df315c5e2e7da71b2b25a1ce770e18590f9f2095bef74c61
-
SSDEEP
98304:IFV3lDzCOXPy7Qf5Iyc4i4iKK8hdC3FuxefuAU8sKzdCu:IdCOVcjmdSF2shzd7
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule behavioral1/memory/896-60-0x0000000000060000-0x0000000000B4C000-memory.dmp dcrat behavioral1/memory/896-61-0x0000000000060000-0x0000000000B4C000-memory.dmp dcrat \Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exe dcrat C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exe dcrat behavioral1/memory/896-71-0x0000000000060000-0x0000000000B4C000-memory.dmp dcrat C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exe dcrat behavioral1/memory/1996-73-0x0000000000180000-0x00000000002C4000-memory.dmp dcrat C:\Users\Default\Music\RustOptimizationSettings.exe dcrat C:\Users\Default\Music\RustOptimizationSettings.exe dcrat behavioral1/memory/672-83-0x0000000000CD0000-0x0000000000E14000-memory.dmp dcrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Executes dropped EXE 3 IoCs
Processes:
RustOptimizationTool.exeRustOptimizationSettings.exeRustOptimizationSettings.exepid process 2040 RustOptimizationTool.exe 1996 RustOptimizationSettings.exe 672 RustOptimizationSettings.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Loads dropped DLL 2 IoCs
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exepid process 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Processes:
resource yara_rule behavioral1/memory/896-60-0x0000000000060000-0x0000000000B4C000-memory.dmp themida behavioral1/memory/896-61-0x0000000000060000-0x0000000000B4C000-memory.dmp themida behavioral1/memory/896-71-0x0000000000060000-0x0000000000B4C000-memory.dmp themida -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
RustOptimizationSettings.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\wininit.exe\"" RustOptimizationSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\RustOptimizationTool = "\"C:\\ProgramData\\Package Cache\\RustOptimizationTool.exe\"" RustOptimizationSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\ProgramData\\Adobe\\Updater6\\services.exe\"" RustOptimizationSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\SoftwareDistribution\\Download\\System.exe\"" RustOptimizationSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\taskhost.exe\"" RustOptimizationSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\RustOptimizationSettings = "\"C:\\Users\\Default\\Music\\RustOptimizationSettings.exe\"" RustOptimizationSettings.exe -
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exepid process 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Drops file in Windows directory 2 IoCs
Processes:
RustOptimizationSettings.exedescription ioc process File created C:\Windows\SoftwareDistribution\Download\System.exe RustOptimizationSettings.exe File created C:\Windows\SoftwareDistribution\Download\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a RustOptimizationSettings.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 284 schtasks.exe 524 schtasks.exe 1484 schtasks.exe 1532 schtasks.exe 1564 schtasks.exe 1152 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RustOptimizationSettings.exeRustOptimizationSettings.exepid process 1996 RustOptimizationSettings.exe 672 RustOptimizationSettings.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RustOptimizationSettings.exeRustOptimizationSettings.exedescription pid process Token: SeDebugPrivilege 1996 RustOptimizationSettings.exe Token: SeDebugPrivilege 672 RustOptimizationSettings.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exeRustOptimizationSettings.exedescription pid process target process PID 896 wrote to memory of 2040 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationTool.exe PID 896 wrote to memory of 2040 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationTool.exe PID 896 wrote to memory of 2040 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationTool.exe PID 896 wrote to memory of 2040 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationTool.exe PID 896 wrote to memory of 1996 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationSettings.exe PID 896 wrote to memory of 1996 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationSettings.exe PID 896 wrote to memory of 1996 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationSettings.exe PID 896 wrote to memory of 1996 896 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationSettings.exe PID 1996 wrote to memory of 1152 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1152 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1152 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 284 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 284 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 284 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 524 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 524 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 524 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1484 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1484 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1484 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1532 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1532 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1532 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1564 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1564 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 1564 1996 RustOptimizationSettings.exe schtasks.exe PID 1996 wrote to memory of 672 1996 RustOptimizationSettings.exe RustOptimizationSettings.exe PID 1996 wrote to memory of 672 1996 RustOptimizationSettings.exe RustOptimizationSettings.exe PID 1996 wrote to memory of 672 1996 RustOptimizationSettings.exe RustOptimizationSettings.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe"C:\Users\Admin\AppData\Local\Temp\21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationTool.exe"C:\Users\Admin\AppData\Local\Temp\RustOptimizationTool.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exe"C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\wininit.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RustOptimizationTool" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\RustOptimizationTool.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\ProgramData\Adobe\Updater6\services.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\Download\System.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RustOptimizationSettings" /sc ONLOGON /tr "'C:\Users\Default\Music\RustOptimizationSettings.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Default\Music\RustOptimizationSettings.exe"C:\Users\Default\Music\RustOptimizationSettings.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exeFilesize
1.2MB
MD5fd1604c0a2a2dd9369703c37628fbbb8
SHA12eef0012fe1f46cef5f3004b71e50c1a9f404375
SHA256db9b04fd7fcd43c44dc0619d329f5d2ed11b17a9b6e7ca98b46bf6955eb978b9
SHA512134d987a23796209d7c51782c6f5bc84fe9b78c8b4555d32ef27e75ddcb1c96bae68260cf5cf96d03248ea2bb1f90bf7e55e9307ecbb58290dc06fad76c7965a
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exeFilesize
1.2MB
MD5fd1604c0a2a2dd9369703c37628fbbb8
SHA12eef0012fe1f46cef5f3004b71e50c1a9f404375
SHA256db9b04fd7fcd43c44dc0619d329f5d2ed11b17a9b6e7ca98b46bf6955eb978b9
SHA512134d987a23796209d7c51782c6f5bc84fe9b78c8b4555d32ef27e75ddcb1c96bae68260cf5cf96d03248ea2bb1f90bf7e55e9307ecbb58290dc06fad76c7965a
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationTool.exeFilesize
5KB
MD5f177a8a583b8410d7b2a715de831f1d6
SHA19329c2aafa6d53625383d2cf1a5cc198b44e1c78
SHA256d4308a409a20c1d60a85dfb314c450d4f2db00f671a77f8ddf5d8c629a81d619
SHA51278b610539378581288e721e166ce33d9b9a77841a49381fd6fa88eb7fe299aa857efcec34f8c2987ce56c45215e8be421776956b5c7c57f6f082f35c75d89735
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationTool.exeFilesize
5KB
MD5f177a8a583b8410d7b2a715de831f1d6
SHA19329c2aafa6d53625383d2cf1a5cc198b44e1c78
SHA256d4308a409a20c1d60a85dfb314c450d4f2db00f671a77f8ddf5d8c629a81d619
SHA51278b610539378581288e721e166ce33d9b9a77841a49381fd6fa88eb7fe299aa857efcec34f8c2987ce56c45215e8be421776956b5c7c57f6f082f35c75d89735
-
C:\Users\Default\Music\RustOptimizationSettings.exeFilesize
1.2MB
MD5fd1604c0a2a2dd9369703c37628fbbb8
SHA12eef0012fe1f46cef5f3004b71e50c1a9f404375
SHA256db9b04fd7fcd43c44dc0619d329f5d2ed11b17a9b6e7ca98b46bf6955eb978b9
SHA512134d987a23796209d7c51782c6f5bc84fe9b78c8b4555d32ef27e75ddcb1c96bae68260cf5cf96d03248ea2bb1f90bf7e55e9307ecbb58290dc06fad76c7965a
-
C:\Users\Default\Music\RustOptimizationSettings.exeFilesize
1.2MB
MD5fd1604c0a2a2dd9369703c37628fbbb8
SHA12eef0012fe1f46cef5f3004b71e50c1a9f404375
SHA256db9b04fd7fcd43c44dc0619d329f5d2ed11b17a9b6e7ca98b46bf6955eb978b9
SHA512134d987a23796209d7c51782c6f5bc84fe9b78c8b4555d32ef27e75ddcb1c96bae68260cf5cf96d03248ea2bb1f90bf7e55e9307ecbb58290dc06fad76c7965a
-
\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exeFilesize
1.2MB
MD5fd1604c0a2a2dd9369703c37628fbbb8
SHA12eef0012fe1f46cef5f3004b71e50c1a9f404375
SHA256db9b04fd7fcd43c44dc0619d329f5d2ed11b17a9b6e7ca98b46bf6955eb978b9
SHA512134d987a23796209d7c51782c6f5bc84fe9b78c8b4555d32ef27e75ddcb1c96bae68260cf5cf96d03248ea2bb1f90bf7e55e9307ecbb58290dc06fad76c7965a
-
\Users\Admin\AppData\Local\Temp\RustOptimizationTool.exeFilesize
5KB
MD5f177a8a583b8410d7b2a715de831f1d6
SHA19329c2aafa6d53625383d2cf1a5cc198b44e1c78
SHA256d4308a409a20c1d60a85dfb314c450d4f2db00f671a77f8ddf5d8c629a81d619
SHA51278b610539378581288e721e166ce33d9b9a77841a49381fd6fa88eb7fe299aa857efcec34f8c2987ce56c45215e8be421776956b5c7c57f6f082f35c75d89735
-
memory/284-75-0x0000000000000000-mapping.dmp
-
memory/524-76-0x0000000000000000-mapping.dmp
-
memory/672-83-0x0000000000CD0000-0x0000000000E14000-memory.dmpFilesize
1.3MB
-
memory/672-80-0x0000000000000000-mapping.dmp
-
memory/896-54-0x0000000000060000-0x0000000000B4C000-memory.dmpFilesize
10.9MB
-
memory/896-56-0x0000000077AC0000-0x0000000077C40000-memory.dmpFilesize
1.5MB
-
memory/896-55-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/896-72-0x0000000077AC0000-0x0000000077C40000-memory.dmpFilesize
1.5MB
-
memory/896-61-0x0000000000060000-0x0000000000B4C000-memory.dmpFilesize
10.9MB
-
memory/896-60-0x0000000000060000-0x0000000000B4C000-memory.dmpFilesize
10.9MB
-
memory/896-71-0x0000000000060000-0x0000000000B4C000-memory.dmpFilesize
10.9MB
-
memory/1152-74-0x0000000000000000-mapping.dmp
-
memory/1484-77-0x0000000000000000-mapping.dmp
-
memory/1532-78-0x0000000000000000-mapping.dmp
-
memory/1564-79-0x0000000000000000-mapping.dmp
-
memory/1996-73-0x0000000000180000-0x00000000002C4000-memory.dmpFilesize
1.3MB
-
memory/1996-66-0x0000000000000000-mapping.dmp
-
memory/2040-63-0x0000000000000000-mapping.dmp
-
memory/2040-70-0x0000000000920000-0x0000000000928000-memory.dmpFilesize
32KB