Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-03-2023 11:21

General

  • Target

    36debef0fda01710af9b0e7b6d990a37.bin.exe

  • Size

    1.1MB

  • MD5

    36debef0fda01710af9b0e7b6d990a37

  • SHA1

    b74d79014b30d14abbfbc7adac9a9c2a484f51b9

  • SHA256

    5d61d2fe577e2a1feac949e6ee980fc9589e4b9472bc4ae249e5d50371ce0e9a

  • SHA512

    a4fdeb9658b23abf6544344131d2504a72512773f9b041a1c83cee137bb248bf5ab28e11b07d21302fa54660e2eff8fb97f8c3b00d4c7cdee237c237f91befa4

  • SSDEEP

    12288:7EOA56TrfgrfGA3hM6iM8QSArLmMcKDJW0lt6/9y4dne+qR/:o5IErf1hTP8ALrDc0lQ/9y4dne

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Panda Stealer payload 4 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36debef0fda01710af9b0e7b6d990a37.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\36debef0fda01710af9b0e7b6d990a37.bin.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2664
    • C:\Users\Admin\AppData\Local\Temp\Xxcmfezhjmaxhvcomintoperf.exe
      "C:\Users\Admin\AppData\Local\Temp\Xxcmfezhjmaxhvcomintoperf.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2956
    • C:\Users\Admin\AppData\Local\Temp\36debef0fda01710af9b0e7b6d990a37.bin.exe
      C:\Users\Admin\AppData\Local\Temp\36debef0fda01710af9b0e7b6d990a37.bin.exe
      2⤵
        PID:4648

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Xxcmfezhjmaxhvcomintoperf.exe

      Filesize

      1.0MB

      MD5

      3a1aa0d3d3fad3ba324feda977846412

      SHA1

      b1423f52ef9060e5c3d77394224f65af757f2f17

      SHA256

      7606edcf0491794b631f9aaf1a7e34fd0960e542d30614b562c8423afc86e2c1

      SHA512

      c9f6d5d9d53fa590c3499c4eeb73bdb2081c9dffdb9aa587672861e5af7b84ae80ff326bc0b738656117d762c1204e256538f4c8703451912d32b88bd171d68f

    • C:\Users\Admin\AppData\Local\Temp\Xxcmfezhjmaxhvcomintoperf.exe

      Filesize

      1.0MB

      MD5

      3a1aa0d3d3fad3ba324feda977846412

      SHA1

      b1423f52ef9060e5c3d77394224f65af757f2f17

      SHA256

      7606edcf0491794b631f9aaf1a7e34fd0960e542d30614b562c8423afc86e2c1

      SHA512

      c9f6d5d9d53fa590c3499c4eeb73bdb2081c9dffdb9aa587672861e5af7b84ae80ff326bc0b738656117d762c1204e256538f4c8703451912d32b88bd171d68f

    • C:\Users\Admin\AppData\Local\Temp\Xxcmfezhjmaxhvcomintoperf.exe

      Filesize

      1.0MB

      MD5

      3a1aa0d3d3fad3ba324feda977846412

      SHA1

      b1423f52ef9060e5c3d77394224f65af757f2f17

      SHA256

      7606edcf0491794b631f9aaf1a7e34fd0960e542d30614b562c8423afc86e2c1

      SHA512

      c9f6d5d9d53fa590c3499c4eeb73bdb2081c9dffdb9aa587672861e5af7b84ae80ff326bc0b738656117d762c1204e256538f4c8703451912d32b88bd171d68f

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bti0cdnx.d3t.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1664-155-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

      Filesize

      64KB

    • memory/1664-133-0x0000000000250000-0x000000000036E000-memory.dmp

      Filesize

      1.1MB

    • memory/1664-134-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

      Filesize

      64KB

    • memory/1664-135-0x0000000006720000-0x0000000006742000-memory.dmp

      Filesize

      136KB

    • memory/2664-158-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

      Filesize

      64KB

    • memory/2664-137-0x0000000005300000-0x0000000005928000-memory.dmp

      Filesize

      6.2MB

    • memory/2664-151-0x00000000061E0000-0x00000000061FE000-memory.dmp

      Filesize

      120KB

    • memory/2664-152-0x0000000007870000-0x0000000007EEA000-memory.dmp

      Filesize

      6.5MB

    • memory/2664-153-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

      Filesize

      64KB

    • memory/2664-154-0x00000000066C0000-0x00000000066DA000-memory.dmp

      Filesize

      104KB

    • memory/2664-149-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

      Filesize

      64KB

    • memory/2664-156-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

      Filesize

      64KB

    • memory/2664-157-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

      Filesize

      64KB

    • memory/2664-138-0x00000000059A0000-0x0000000005A06000-memory.dmp

      Filesize

      408KB

    • memory/2664-136-0x0000000004C10000-0x0000000004C46000-memory.dmp

      Filesize

      216KB

    • memory/2664-150-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

      Filesize

      64KB

    • memory/2664-139-0x0000000005BC0000-0x0000000005C26000-memory.dmp

      Filesize

      408KB

    • memory/2956-173-0x00000000005F0000-0x0000000000702000-memory.dmp

      Filesize

      1.1MB

    • memory/2956-175-0x000000001C9C0000-0x000000001C9D0000-memory.dmp

      Filesize

      64KB

    • memory/2956-180-0x000000001CED0000-0x000000001CF20000-memory.dmp

      Filesize

      320KB

    • memory/2956-181-0x000000001D690000-0x000000001DBB8000-memory.dmp

      Filesize

      5.2MB

    • memory/2956-183-0x000000001C9C0000-0x000000001C9D0000-memory.dmp

      Filesize

      64KB

    • memory/2956-184-0x000000001E590000-0x000000001E752000-memory.dmp

      Filesize

      1.8MB

    • memory/4648-176-0x0000000000400000-0x00000000004A3000-memory.dmp

      Filesize

      652KB

    • memory/4648-178-0x0000000000400000-0x00000000004A3000-memory.dmp

      Filesize

      652KB

    • memory/4648-179-0x0000000000400000-0x00000000004A3000-memory.dmp

      Filesize

      652KB

    • memory/4648-182-0x0000000000400000-0x00000000004A3000-memory.dmp

      Filesize

      652KB