Analysis
-
max time kernel
37s -
max time network
55s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 20:24
Behavioral task
behavioral1
Sample
51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe
Resource
win10v2004-20220812-en
General
-
Target
51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe
-
Size
413KB
-
MD5
d42e209f293b2f4551ca20bbfaf685bf
-
SHA1
5e77d2a5933e32b57ef96464e94d4a2b692f6421
-
SHA256
51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2
-
SHA512
62580c3a1524d46c907b6c040d20bb67dbf375bc5c9fb0452bdadb30f21e42b9c1e40f0176ebd6eb437f2f7f47825398febaa147f0cb4459c2b19dbd011d0787
-
SSDEEP
12288:XQndjOJNp/0+fS4qVleduxRTP42SgJ3H+DEqn:AndjOJbjS4qVleduxRTP42SgBb+
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule behavioral1/memory/1736-54-0x0000000000860000-0x00000000008CE000-memory.dmp dcrat C:\ProgramData\Microsoft Help\WmiPrvSE.exe dcrat C:\ProgramData\Microsoft Help\WmiPrvSE.exe dcrat behavioral1/memory/1352-64-0x0000000000010000-0x000000000007E000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
WmiPrvSE.exepid process 1352 WmiPrvSE.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\schemas\\AvailableNetwork\\dwm.exe\"" 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\Favorites\\csrss.exe\"" 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\\lsass.exe\"" 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\PerfLogs\\Admin\\spoolsv.exe\"" 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\PerfLogs\\Admin\\WMIADAP.exe\"" 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\ProgramData\\Microsoft Help\\WmiPrvSE.exe\"" 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe -
Drops file in Windows directory 3 IoCs
Processes:
51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exedescription ioc process File created C:\Windows\schemas\AvailableNetwork\dwm.exe 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe File opened for modification C:\Windows\schemas\AvailableNetwork\dwm.exe 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe File created C:\Windows\schemas\AvailableNetwork\6cb0b6c459d5d3455a3da700e713f2e2529862ff 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1500 schtasks.exe 772 schtasks.exe 1440 schtasks.exe 1572 schtasks.exe 920 schtasks.exe 664 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exeWmiPrvSE.exepid process 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe 1352 WmiPrvSE.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exeWmiPrvSE.exedescription pid process Token: SeDebugPrivilege 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe Token: SeDebugPrivilege 1352 WmiPrvSE.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exedescription pid process target process PID 1736 wrote to memory of 664 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 664 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 664 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1500 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1500 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1500 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 772 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 772 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 772 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1440 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1440 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1440 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1572 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1572 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1572 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 920 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 920 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 920 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe schtasks.exe PID 1736 wrote to memory of 1352 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe WmiPrvSE.exe PID 1736 wrote to memory of 1352 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe WmiPrvSE.exe PID 1736 wrote to memory of 1352 1736 51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe WmiPrvSE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe"C:\Users\Admin\AppData\Local\Temp\51757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\schemas\AvailableNetwork\dwm.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Favorites\csrss.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\lsass.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\PerfLogs\Admin\spoolsv.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\PerfLogs\Admin\WMIADAP.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\ProgramData\Microsoft Help\WmiPrvSE.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\ProgramData\Microsoft Help\WmiPrvSE.exe"C:\ProgramData\Microsoft Help\WmiPrvSE.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft Help\WmiPrvSE.exeFilesize
413KB
MD5d42e209f293b2f4551ca20bbfaf685bf
SHA15e77d2a5933e32b57ef96464e94d4a2b692f6421
SHA25651757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2
SHA51262580c3a1524d46c907b6c040d20bb67dbf375bc5c9fb0452bdadb30f21e42b9c1e40f0176ebd6eb437f2f7f47825398febaa147f0cb4459c2b19dbd011d0787
-
C:\ProgramData\Microsoft Help\WmiPrvSE.exeFilesize
413KB
MD5d42e209f293b2f4551ca20bbfaf685bf
SHA15e77d2a5933e32b57ef96464e94d4a2b692f6421
SHA25651757c2b6e29dce91c13dc76c9a75fba921144d80adc56e3fb36e3491ad461d2
SHA51262580c3a1524d46c907b6c040d20bb67dbf375bc5c9fb0452bdadb30f21e42b9c1e40f0176ebd6eb437f2f7f47825398febaa147f0cb4459c2b19dbd011d0787
-
memory/664-55-0x0000000000000000-mapping.dmp
-
memory/772-57-0x0000000000000000-mapping.dmp
-
memory/920-60-0x0000000000000000-mapping.dmp
-
memory/1352-61-0x0000000000000000-mapping.dmp
-
memory/1352-64-0x0000000000010000-0x000000000007E000-memory.dmpFilesize
440KB
-
memory/1440-58-0x0000000000000000-mapping.dmp
-
memory/1500-56-0x0000000000000000-mapping.dmp
-
memory/1572-59-0x0000000000000000-mapping.dmp
-
memory/1736-54-0x0000000000860000-0x00000000008CE000-memory.dmpFilesize
440KB