Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 22:00
Behavioral task
behavioral1
Sample
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe
Resource
win10v2004-20220812-en
General
-
Target
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe
-
Size
4.6MB
-
MD5
43334042325d6a1a3ae84729cb8b5cb0
-
SHA1
a1552e1c54b9024db5b75df401f76e510086c80e
-
SHA256
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e
-
SHA512
c08e24a7197af85f0446404ba0531cd81d313712b2f83e394b498bc842604f15b181bc93d8220959df315c5e2e7da71b2b25a1ce770e18590f9f2095bef74c61
-
SSDEEP
98304:IFV3lDzCOXPy7Qf5Iyc4i4iKK8hdC3FuxefuAU8sKzdCu:IdCOVcjmdSF2shzd7
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule behavioral2/memory/4112-138-0x0000000000CB0000-0x000000000179C000-memory.dmp dcrat behavioral2/memory/4112-139-0x0000000000CB0000-0x000000000179C000-memory.dmp dcrat C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exe dcrat C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exe dcrat behavioral2/memory/4716-149-0x00000297ADF00000-0x00000297AE044000-memory.dmp dcrat behavioral2/memory/4112-150-0x0000000000CB0000-0x000000000179C000-memory.dmp dcrat C:\Windows\SystemResources\Windows.UI.Shell\pris\System.exe dcrat C:\Windows\SystemResources\Windows.UI.Shell\pris\System.exe dcrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Executes dropped EXE 3 IoCs
Processes:
RustOptimizationTool.exeRustOptimizationSettings.exeSystem.exepid process 4732 RustOptimizationTool.exe 4716 RustOptimizationSettings.exe 4612 System.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Processes:
resource yara_rule behavioral2/memory/4112-138-0x0000000000CB0000-0x000000000179C000-memory.dmp themida behavioral2/memory/4112-139-0x0000000000CB0000-0x000000000179C000-memory.dmp themida behavioral2/memory/4112-150-0x0000000000CB0000-0x000000000179C000-memory.dmp themida -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
RustOptimizationSettings.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\PLA\\Templates\\conhost.exe\"" RustOptimizationSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Google\\CrashReports\\csrss.exe\"" RustOptimizationSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Users\\Admin\\Saved Games\\conhost.exe\"" RustOptimizationSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\odt\\conhost.exe\"" RustOptimizationSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\es-ES\\StartMenuExperienceHost.exe\"" RustOptimizationSettings.exe -
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exepid process 4112 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe -
Drops file in Program Files directory 4 IoCs
Processes:
RustOptimizationSettings.exedescription ioc process File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\55b276f4edf653fe07efe8f1ecc32d3d195abd16 RustOptimizationSettings.exe File created C:\Program Files (x86)\Google\CrashReports\csrss.exe RustOptimizationSettings.exe File created C:\Program Files (x86)\Google\CrashReports\886983d96e3d3e31032c679b2d4ea91b6c05afef RustOptimizationSettings.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\StartMenuExperienceHost.exe RustOptimizationSettings.exe -
Drops file in Windows directory 5 IoCs
Processes:
RustOptimizationSettings.exedescription ioc process File created C:\Windows\PLA\Templates\conhost.exe RustOptimizationSettings.exe File opened for modification C:\Windows\PLA\Templates\conhost.exe RustOptimizationSettings.exe File created C:\Windows\PLA\Templates\088424020bedd6b28ac7fd22ee35dcd7322895ce RustOptimizationSettings.exe File created C:\Windows\SystemResources\Windows.UI.Shell\pris\System.exe RustOptimizationSettings.exe File created C:\Windows\SystemResources\Windows.UI.Shell\pris\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a RustOptimizationSettings.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3764 schtasks.exe 3692 schtasks.exe 1656 schtasks.exe 3732 schtasks.exe 3388 schtasks.exe 3416 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RustOptimizationSettings.exeSystem.exepid process 4716 RustOptimizationSettings.exe 4612 System.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RustOptimizationSettings.exeSystem.exedescription pid process Token: SeDebugPrivilege 4716 RustOptimizationSettings.exe Token: SeDebugPrivilege 4612 System.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exeRustOptimizationSettings.exedescription pid process target process PID 4112 wrote to memory of 4732 4112 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationTool.exe PID 4112 wrote to memory of 4732 4112 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationTool.exe PID 4112 wrote to memory of 4732 4112 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationTool.exe PID 4112 wrote to memory of 4716 4112 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationSettings.exe PID 4112 wrote to memory of 4716 4112 21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe RustOptimizationSettings.exe PID 4716 wrote to memory of 3764 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 3764 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 3692 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 3692 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 1656 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 1656 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 3732 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 3732 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 3388 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 3388 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 3416 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 3416 4716 RustOptimizationSettings.exe schtasks.exe PID 4716 wrote to memory of 4612 4716 RustOptimizationSettings.exe System.exe PID 4716 wrote to memory of 4612 4716 RustOptimizationSettings.exe System.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe"C:\Users\Admin\AppData\Local\Temp\21a9f82942e3d5b88a1180b1d6bc2082648db67d2d0257b67d07fe531ecfef0e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationTool.exe"C:\Users\Admin\AppData\Local\Temp\RustOptimizationTool.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exe"C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\conhost.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\csrss.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\conhost.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\StartMenuExperienceHost.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.Shell\pris\System.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SystemResources\Windows.UI.Shell\pris\System.exe"C:\Windows\SystemResources\Windows.UI.Shell\pris\System.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exeFilesize
1.2MB
MD5fd1604c0a2a2dd9369703c37628fbbb8
SHA12eef0012fe1f46cef5f3004b71e50c1a9f404375
SHA256db9b04fd7fcd43c44dc0619d329f5d2ed11b17a9b6e7ca98b46bf6955eb978b9
SHA512134d987a23796209d7c51782c6f5bc84fe9b78c8b4555d32ef27e75ddcb1c96bae68260cf5cf96d03248ea2bb1f90bf7e55e9307ecbb58290dc06fad76c7965a
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationSettings.exeFilesize
1.2MB
MD5fd1604c0a2a2dd9369703c37628fbbb8
SHA12eef0012fe1f46cef5f3004b71e50c1a9f404375
SHA256db9b04fd7fcd43c44dc0619d329f5d2ed11b17a9b6e7ca98b46bf6955eb978b9
SHA512134d987a23796209d7c51782c6f5bc84fe9b78c8b4555d32ef27e75ddcb1c96bae68260cf5cf96d03248ea2bb1f90bf7e55e9307ecbb58290dc06fad76c7965a
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationTool.exeFilesize
5KB
MD5f177a8a583b8410d7b2a715de831f1d6
SHA19329c2aafa6d53625383d2cf1a5cc198b44e1c78
SHA256d4308a409a20c1d60a85dfb314c450d4f2db00f671a77f8ddf5d8c629a81d619
SHA51278b610539378581288e721e166ce33d9b9a77841a49381fd6fa88eb7fe299aa857efcec34f8c2987ce56c45215e8be421776956b5c7c57f6f082f35c75d89735
-
C:\Users\Admin\AppData\Local\Temp\RustOptimizationTool.exeFilesize
5KB
MD5f177a8a583b8410d7b2a715de831f1d6
SHA19329c2aafa6d53625383d2cf1a5cc198b44e1c78
SHA256d4308a409a20c1d60a85dfb314c450d4f2db00f671a77f8ddf5d8c629a81d619
SHA51278b610539378581288e721e166ce33d9b9a77841a49381fd6fa88eb7fe299aa857efcec34f8c2987ce56c45215e8be421776956b5c7c57f6f082f35c75d89735
-
C:\Windows\SystemResources\Windows.UI.Shell\pris\System.exeFilesize
1.2MB
MD5fd1604c0a2a2dd9369703c37628fbbb8
SHA12eef0012fe1f46cef5f3004b71e50c1a9f404375
SHA256db9b04fd7fcd43c44dc0619d329f5d2ed11b17a9b6e7ca98b46bf6955eb978b9
SHA512134d987a23796209d7c51782c6f5bc84fe9b78c8b4555d32ef27e75ddcb1c96bae68260cf5cf96d03248ea2bb1f90bf7e55e9307ecbb58290dc06fad76c7965a
-
C:\Windows\SystemResources\Windows.UI.Shell\pris\System.exeFilesize
1.2MB
MD5fd1604c0a2a2dd9369703c37628fbbb8
SHA12eef0012fe1f46cef5f3004b71e50c1a9f404375
SHA256db9b04fd7fcd43c44dc0619d329f5d2ed11b17a9b6e7ca98b46bf6955eb978b9
SHA512134d987a23796209d7c51782c6f5bc84fe9b78c8b4555d32ef27e75ddcb1c96bae68260cf5cf96d03248ea2bb1f90bf7e55e9307ecbb58290dc06fad76c7965a
-
memory/1656-156-0x0000000000000000-mapping.dmp
-
memory/3388-158-0x0000000000000000-mapping.dmp
-
memory/3416-159-0x0000000000000000-mapping.dmp
-
memory/3692-155-0x0000000000000000-mapping.dmp
-
memory/3732-157-0x0000000000000000-mapping.dmp
-
memory/3764-154-0x0000000000000000-mapping.dmp
-
memory/4112-141-0x0000000077520000-0x00000000776C3000-memory.dmpFilesize
1.6MB
-
memory/4112-132-0x0000000000CB0000-0x000000000179C000-memory.dmpFilesize
10.9MB
-
memory/4112-150-0x0000000000CB0000-0x000000000179C000-memory.dmpFilesize
10.9MB
-
memory/4112-151-0x0000000077520000-0x00000000776C3000-memory.dmpFilesize
1.6MB
-
memory/4112-140-0x00000000064E0000-0x0000000006A84000-memory.dmpFilesize
5.6MB
-
memory/4112-139-0x0000000000CB0000-0x000000000179C000-memory.dmpFilesize
10.9MB
-
memory/4112-138-0x0000000000CB0000-0x000000000179C000-memory.dmpFilesize
10.9MB
-
memory/4112-134-0x0000000077520000-0x00000000776C3000-memory.dmpFilesize
1.6MB
-
memory/4112-133-0x0000000000CB0000-0x000000000179C000-memory.dmpFilesize
10.9MB
-
memory/4612-164-0x00007FFFDEF20000-0x00007FFFDF9E1000-memory.dmpFilesize
10.8MB
-
memory/4612-165-0x00007FFFDEF20000-0x00007FFFDF9E1000-memory.dmpFilesize
10.8MB
-
memory/4612-160-0x0000000000000000-mapping.dmp
-
memory/4716-149-0x00000297ADF00000-0x00000297AE044000-memory.dmpFilesize
1.3MB
-
memory/4716-153-0x00007FFFDEF20000-0x00007FFFDF9E1000-memory.dmpFilesize
10.8MB
-
memory/4716-152-0x00007FFFDEF20000-0x00007FFFDF9E1000-memory.dmpFilesize
10.8MB
-
memory/4716-163-0x00007FFFDEF20000-0x00007FFFDF9E1000-memory.dmpFilesize
10.8MB
-
memory/4716-145-0x0000000000000000-mapping.dmp
-
memory/4732-148-0x0000000000530000-0x0000000000538000-memory.dmpFilesize
32KB
-
memory/4732-142-0x0000000000000000-mapping.dmp