Analysis
-
max time kernel
178s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
10-02-2023 06:40
Static task
static1
Behavioral task
behavioral1
Sample
bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe
Resource
win10v2004-20221111-en
General
-
Target
bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe
-
Size
1.3MB
-
MD5
ef87f963668f52d60ccc2e9742f40d27
-
SHA1
72d22dd53d2b81a28830c882060e61d66d4c9913
-
SHA256
bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495
-
SHA512
b7076589a9540613fd97f30eb431e3d8bdf439ab43c2262596ce2684cb74ce9c93ff35f9577fbe75267b80c82d690039a8c1fc244adb7d62285befa0e3a44ef2
-
SSDEEP
24576:VwcxYIu8NZSs53CZDXPIPljai7zFlj6zxyWxZy2QQVqTrx0G:VwcSIu7I9jDzFQhxnw0G
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Panda Stealer payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exe family_pandastealer C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exe family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 212 4720 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 176 4720 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1892 4720 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3328 4720 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 760 4720 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4480 4720 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4804 4720 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 400 4720 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4156 4720 schtasks.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe dcrat C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe dcrat C:\Bridgehyperintosvc\SessionRuntime.exe dcrat C:\Bridgehyperintosvc\SessionRuntime.exe dcrat behavioral2/memory/460-145-0x0000000000070000-0x0000000000146000-memory.dmp dcrat C:\Program Files\Windows Mail\sppsvc.exe dcrat C:\Program Files\Windows Mail\sppsvc.exe dcrat -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exeSessionRuntime.exebbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exeDCRatBuild.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation SessionRuntime.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation DCRatBuild.exe -
Executes dropped EXE 4 IoCs
Processes:
DCRatBuild.exeprikol for ragemp.exeSessionRuntime.exesppsvc.exepid process 2032 DCRatBuild.exe 840 prikol for ragemp.exe 460 SessionRuntime.exe 1800 sppsvc.exe -
Drops file in Program Files directory 5 IoCs
Processes:
SessionRuntime.exedescription ioc process File created C:\Program Files\Windows Mail\0a1fd5f707cd16 SessionRuntime.exe File created C:\Program Files\Windows Media Player\de-DE\SppExtComObj.exe SessionRuntime.exe File created C:\Program Files\Windows Media Player\de-DE\e1ef82546f0b02 SessionRuntime.exe File created C:\Program Files\Windows Mail\sppsvc.exe SessionRuntime.exe File opened for modification C:\Program Files\Windows Mail\sppsvc.exe SessionRuntime.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 760 schtasks.exe 4480 schtasks.exe 4156 schtasks.exe 212 schtasks.exe 3328 schtasks.exe 4804 schtasks.exe 400 schtasks.exe 176 schtasks.exe 1892 schtasks.exe -
Modifies registry class 2 IoCs
Processes:
DCRatBuild.exeSessionRuntime.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings DCRatBuild.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings SessionRuntime.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
SessionRuntime.exesppsvc.exepid process 460 SessionRuntime.exe 1800 sppsvc.exe 1800 sppsvc.exe 1800 sppsvc.exe 1800 sppsvc.exe 1800 sppsvc.exe 1800 sppsvc.exe 1800 sppsvc.exe 1800 sppsvc.exe 1800 sppsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SessionRuntime.exesppsvc.exedescription pid process Token: SeDebugPrivilege 460 SessionRuntime.exe Token: SeDebugPrivilege 1800 sppsvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exeDCRatBuild.exeWScript.execmd.exeSessionRuntime.execmd.exedescription pid process target process PID 4348 wrote to memory of 2032 4348 bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe DCRatBuild.exe PID 4348 wrote to memory of 2032 4348 bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe DCRatBuild.exe PID 4348 wrote to memory of 2032 4348 bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe DCRatBuild.exe PID 4348 wrote to memory of 840 4348 bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe prikol for ragemp.exe PID 4348 wrote to memory of 840 4348 bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe prikol for ragemp.exe PID 4348 wrote to memory of 840 4348 bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe prikol for ragemp.exe PID 2032 wrote to memory of 1384 2032 DCRatBuild.exe WScript.exe PID 2032 wrote to memory of 1384 2032 DCRatBuild.exe WScript.exe PID 2032 wrote to memory of 1384 2032 DCRatBuild.exe WScript.exe PID 1384 wrote to memory of 1612 1384 WScript.exe cmd.exe PID 1384 wrote to memory of 1612 1384 WScript.exe cmd.exe PID 1384 wrote to memory of 1612 1384 WScript.exe cmd.exe PID 1612 wrote to memory of 460 1612 cmd.exe SessionRuntime.exe PID 1612 wrote to memory of 460 1612 cmd.exe SessionRuntime.exe PID 460 wrote to memory of 4060 460 SessionRuntime.exe cmd.exe PID 460 wrote to memory of 4060 460 SessionRuntime.exe cmd.exe PID 4060 wrote to memory of 1668 4060 cmd.exe w32tm.exe PID 4060 wrote to memory of 1668 4060 cmd.exe w32tm.exe PID 4060 wrote to memory of 1800 4060 cmd.exe sppsvc.exe PID 4060 wrote to memory of 1800 4060 cmd.exe sppsvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe"C:\Users\Admin\AppData\Local\Temp\bbcf7cdd19b030f97ba12f202a8966f68d36e28e298e88a88589652648100495.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Bridgehyperintosvc\hhW91xccJcHbriwNxwh8J2VR4DfT.vbe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Bridgehyperintosvc\qmwizXZyAG.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Bridgehyperintosvc\SessionRuntime.exe"C:\Bridgehyperintosvc\SessionRuntime.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wfEj2T8k6F.bat"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵
-
C:\Program Files\Windows Mail\sppsvc.exe"C:\Program Files\Windows Mail\sppsvc.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exe"C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\de-DE\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\de-DE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\de-DE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\odt\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Bridgehyperintosvc\SessionRuntime.exeFilesize
828KB
MD5ae23ccbd31f96a4051015724d155f40e
SHA1799439e532b69c36f2e1fb5346ae7f93510c9594
SHA256c68a49ebcf23549fd40879c7e7d95737effd1c3d704689dbe1bba4959dcbbd69
SHA51261f683a97b8bc1550af40253e2c2e42d8edf4a5c06afb3f5dcc9216ab10c16550f9647ac6dbc85c1f5b3b7b8ab860090ccd6b92b8f41905264b079baf3ae16f8
-
C:\Bridgehyperintosvc\SessionRuntime.exeFilesize
828KB
MD5ae23ccbd31f96a4051015724d155f40e
SHA1799439e532b69c36f2e1fb5346ae7f93510c9594
SHA256c68a49ebcf23549fd40879c7e7d95737effd1c3d704689dbe1bba4959dcbbd69
SHA51261f683a97b8bc1550af40253e2c2e42d8edf4a5c06afb3f5dcc9216ab10c16550f9647ac6dbc85c1f5b3b7b8ab860090ccd6b92b8f41905264b079baf3ae16f8
-
C:\Bridgehyperintosvc\hhW91xccJcHbriwNxwh8J2VR4DfT.vbeFilesize
205B
MD569a1055c45c69385f54f6c9f2f90d3b5
SHA13d5e79e4c9ce42ffe83b78ec8dc56a19d281c4b5
SHA2562c20f9301f7693eb0b2c66c6847e4f225526d912cd1a3991e0fbeaa2297e4cf2
SHA512c5cc288244b50182e61102e736888980f0de1bbcc596dd03f6d928f41d91dbcc38a799c813ea762f541e151ac0e62fb5b5d0d69bcf367c67fd55ede6d0c4411d
-
C:\Bridgehyperintosvc\qmwizXZyAG.batFilesize
42B
MD511638d0e4750c66f861582ba291fab83
SHA12b355fd2188f0474799060d308123d4d9fdbea53
SHA2567663a9d61b00888cb9aec3aefd0829f83a1358f53d4141525b13f2c4c6beb4a8
SHA51277cd768c8c4718221961c1d07ee7c4296432f135c47a18e244d4d5d6b8067feade2e46a8db93a61040212d87df8a888e23f9ed1065ad3c0314ad3ab2ef43139e
-
C:\Program Files\Windows Mail\sppsvc.exeFilesize
828KB
MD5ae23ccbd31f96a4051015724d155f40e
SHA1799439e532b69c36f2e1fb5346ae7f93510c9594
SHA256c68a49ebcf23549fd40879c7e7d95737effd1c3d704689dbe1bba4959dcbbd69
SHA51261f683a97b8bc1550af40253e2c2e42d8edf4a5c06afb3f5dcc9216ab10c16550f9647ac6dbc85c1f5b3b7b8ab860090ccd6b92b8f41905264b079baf3ae16f8
-
C:\Program Files\Windows Mail\sppsvc.exeFilesize
828KB
MD5ae23ccbd31f96a4051015724d155f40e
SHA1799439e532b69c36f2e1fb5346ae7f93510c9594
SHA256c68a49ebcf23549fd40879c7e7d95737effd1c3d704689dbe1bba4959dcbbd69
SHA51261f683a97b8bc1550af40253e2c2e42d8edf4a5c06afb3f5dcc9216ab10c16550f9647ac6dbc85c1f5b3b7b8ab860090ccd6b92b8f41905264b079baf3ae16f8
-
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exeFilesize
1.1MB
MD5a2c5f46a7d17c9844358eb6500a345cb
SHA1bb3e57b426e1bf102d865e43eb2afb3950858d1e
SHA25619490af8d7da0244954c09bb56e6cfc2543b22627fce1eb4662ef450d94e957d
SHA5128317eb7d0e3e25f614c7c739ae78b30a04b7ea95bcb62e209ab5b4e8e56515a8e344da69f0653e2b10fcd0d52479410a21dbe93231fdbdc2858364ffc3f7e2fd
-
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exeFilesize
1.1MB
MD5a2c5f46a7d17c9844358eb6500a345cb
SHA1bb3e57b426e1bf102d865e43eb2afb3950858d1e
SHA25619490af8d7da0244954c09bb56e6cfc2543b22627fce1eb4662ef450d94e957d
SHA5128317eb7d0e3e25f614c7c739ae78b30a04b7ea95bcb62e209ab5b4e8e56515a8e344da69f0653e2b10fcd0d52479410a21dbe93231fdbdc2858364ffc3f7e2fd
-
C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exeFilesize
632KB
MD56040707130367eb1bc81b9676f15fc54
SHA19e646196cd9b221f0b5177c48ee598fd996a1e87
SHA25638c9837521f53f72d53ce83e6b3be97b57c20eea9a52b44672842683fa6b3409
SHA512a736dc596821761ee8e018fa6f4f2709fa70aa745900b6882a2588e4cda9be132fd263f7284ed5a565822c767f12d4d9bc8696516b00434158c0181ce86b22ac
-
C:\Users\Admin\AppData\Local\Temp\prikol for ragemp.exeFilesize
632KB
MD56040707130367eb1bc81b9676f15fc54
SHA19e646196cd9b221f0b5177c48ee598fd996a1e87
SHA25638c9837521f53f72d53ce83e6b3be97b57c20eea9a52b44672842683fa6b3409
SHA512a736dc596821761ee8e018fa6f4f2709fa70aa745900b6882a2588e4cda9be132fd263f7284ed5a565822c767f12d4d9bc8696516b00434158c0181ce86b22ac
-
C:\Users\Admin\AppData\Local\Temp\wfEj2T8k6F.batFilesize
205B
MD50538ee666d9a6d45194e1caf90a5b125
SHA1ef1cd8d594bdd37f1a7644f69a325509e97d0c08
SHA2561c6a524c4224b8c8eb118530af53c5f60c606b607ed22191f5d8a3b74afdfbfb
SHA512072e8bc113d830e8a90fc7530c18bab094c3c428ff2489c58d27a7525a3ffb6997e2ae4e26e611ba017964e02fda074fa5057af0c45c6cf545ed159065ccb3a5
-
memory/460-149-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmpFilesize
10.8MB
-
memory/460-142-0x0000000000000000-mapping.dmp
-
memory/460-145-0x0000000000070000-0x0000000000146000-memory.dmpFilesize
856KB
-
memory/460-146-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmpFilesize
10.8MB
-
memory/460-147-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmpFilesize
10.8MB
-
memory/840-134-0x0000000000000000-mapping.dmp
-
memory/1384-138-0x0000000000000000-mapping.dmp
-
memory/1612-141-0x0000000000000000-mapping.dmp
-
memory/1668-151-0x0000000000000000-mapping.dmp
-
memory/1800-152-0x0000000000000000-mapping.dmp
-
memory/1800-155-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmpFilesize
10.8MB
-
memory/1800-156-0x00007FFCFF510000-0x00007FFCFFFD1000-memory.dmpFilesize
10.8MB
-
memory/2032-132-0x0000000000000000-mapping.dmp
-
memory/4060-148-0x0000000000000000-mapping.dmp