Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 21:36

General

  • Target

    a0fb4af03514fe70e036bbea624ea81f.exe

  • Size

    1.6MB

  • MD5

    a0fb4af03514fe70e036bbea624ea81f

  • SHA1

    435f3ef79e360d89cab884e990a558722c9ce272

  • SHA256

    82b8546043bca13cf187119fb68cdabd9ffef9688e16eaff06211d52bb36249b

  • SHA512

    d3bc4a717f7057b4b2da642c6272f0d357dc0bdf39f898931491e409d4b58790a715138541668a56046c5332178ddb10fc439e5c4d0a7ac6825b82f34e9c268c

  • SSDEEP

    24576:B2G/nvxW3WQnkHnDIlJzbBA5clWJG4kQy0ohgEGdHKK5Cu8Kc9mfCQbZ8/zARp:BbA37kHnDIbzi5MWjmuHNKQbi/E/

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0fb4af03514fe70e036bbea624ea81f.exe
    "C:\Users\Admin\AppData\Local\Temp\a0fb4af03514fe70e036bbea624ea81f.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\PortfontWin\faioFQaWMfyQql5F1lpCdLP.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3492
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\PortfontWin\ItIWhmVbvimfR.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4112
        • C:\PortfontWin\agentNet.exe
          "C:\PortfontWin\agentNet.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1080
          • C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RuntimeBroker.exe
            "C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RuntimeBroker.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2252
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\PortfontWin\file.vbs"
      2⤵
        PID:212
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RuntimeBroker.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4948
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3348
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4388
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\dwm.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3460
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3284
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3312
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\System.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4376
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3692
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4476

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PortfontWin\ItIWhmVbvimfR.bat
      Filesize

      29B

      MD5

      fd0d6ddda55e2608a242669717a0d517

      SHA1

      294004545081c4634c07f7cca31819207588c310

      SHA256

      dd0a8c6636afc291a09f480b9294860f6412555b0bfda3808917eff3637a005d

      SHA512

      d23fddbf26c32b50c3fe3eb654da3ac25e84b7d5bf3501c682bac74f39295a58c1072dd02b97e340a0ec28e30c58ed1bb1448badb5e680baea4d6bce769215a0

    • C:\PortfontWin\agentNet.exe
      Filesize

      1.3MB

      MD5

      cd663693d7804e051bd4d890a643a521

      SHA1

      186510d39cc3a7d928f47c3d6813c27c5e7e3674

      SHA256

      f950a9b3a3930c29d9fadeee93d8e25d5771008c0f0ed492616802977b4fb873

      SHA512

      a5a5be5ad57ea6eb18ec7ad8d0ae73f7867c10b6c34ce7152daeef8a99206ddca0fc121ba90a939b39aada01e313de1254dfdaf3e5f20769a8d7ba5254174c0e

    • C:\PortfontWin\agentNet.exe
      Filesize

      1.3MB

      MD5

      cd663693d7804e051bd4d890a643a521

      SHA1

      186510d39cc3a7d928f47c3d6813c27c5e7e3674

      SHA256

      f950a9b3a3930c29d9fadeee93d8e25d5771008c0f0ed492616802977b4fb873

      SHA512

      a5a5be5ad57ea6eb18ec7ad8d0ae73f7867c10b6c34ce7152daeef8a99206ddca0fc121ba90a939b39aada01e313de1254dfdaf3e5f20769a8d7ba5254174c0e

    • C:\PortfontWin\faioFQaWMfyQql5F1lpCdLP.vbe
      Filesize

      201B

      MD5

      d82d15119bf0f8e8e3077d786bcbbefb

      SHA1

      92a74c59f2984d8f7f9fcd22f44c463cc0177cbd

      SHA256

      1be73a1a92fa60e7ec1ab2b7777780d7f958c284b4c1596ea9ab5c3ad581e76f

      SHA512

      9aaa9dd3906c1b531b9c85f61b9da3d11f458f7eba22a4107fa4ed49868b45f1d0f804296f1ef35c62115d77204b99c235c9e6f504b65d752caf3f58c44eacaa

    • C:\PortfontWin\file.vbs
      Filesize

      34B

      MD5

      677cc4360477c72cb0ce00406a949c61

      SHA1

      b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

      SHA256

      f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

      SHA512

      7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

    • C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RuntimeBroker.exe
      Filesize

      1.3MB

      MD5

      cd663693d7804e051bd4d890a643a521

      SHA1

      186510d39cc3a7d928f47c3d6813c27c5e7e3674

      SHA256

      f950a9b3a3930c29d9fadeee93d8e25d5771008c0f0ed492616802977b4fb873

      SHA512

      a5a5be5ad57ea6eb18ec7ad8d0ae73f7867c10b6c34ce7152daeef8a99206ddca0fc121ba90a939b39aada01e313de1254dfdaf3e5f20769a8d7ba5254174c0e

    • C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RuntimeBroker.exe
      Filesize

      1.3MB

      MD5

      cd663693d7804e051bd4d890a643a521

      SHA1

      186510d39cc3a7d928f47c3d6813c27c5e7e3674

      SHA256

      f950a9b3a3930c29d9fadeee93d8e25d5771008c0f0ed492616802977b4fb873

      SHA512

      a5a5be5ad57ea6eb18ec7ad8d0ae73f7867c10b6c34ce7152daeef8a99206ddca0fc121ba90a939b39aada01e313de1254dfdaf3e5f20769a8d7ba5254174c0e

    • C:\Users\Admin\dwm.exe
      Filesize

      1.3MB

      MD5

      cd663693d7804e051bd4d890a643a521

      SHA1

      186510d39cc3a7d928f47c3d6813c27c5e7e3674

      SHA256

      f950a9b3a3930c29d9fadeee93d8e25d5771008c0f0ed492616802977b4fb873

      SHA512

      a5a5be5ad57ea6eb18ec7ad8d0ae73f7867c10b6c34ce7152daeef8a99206ddca0fc121ba90a939b39aada01e313de1254dfdaf3e5f20769a8d7ba5254174c0e

    • memory/1080-150-0x00000000007C0000-0x0000000000910000-memory.dmp
      Filesize

      1.3MB

    • memory/1080-151-0x000000001CAD0000-0x000000001CAE0000-memory.dmp
      Filesize

      64KB

    • memory/1080-152-0x000000001CA50000-0x000000001CAA0000-memory.dmp
      Filesize

      320KB

    • memory/1080-153-0x000000001D7B0000-0x000000001DCD8000-memory.dmp
      Filesize

      5.2MB