Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-05-2023 06:32
Behavioral task
behavioral1
Sample
02588099.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
02588099.exe
Resource
win10v2004-20230220-en
General
-
Target
02588099.exe
-
Size
1.3MB
-
MD5
6f6a61090a9add724eebbec1c558826b
-
SHA1
566ea8db4bcea2d078fb71be08bc8e7003e36119
-
SHA256
c6244c8e4e4cdecd641017d52d344b1db6a23d05fd6a8ad338c8f4f77481f483
-
SHA512
47d88347a9082186b9667fcf3994d2fe212f09a5665cc82017d48f8833e8a67823b6b66bf3a5dbda5369dd6d1585248389e213a4b3556e8b0b0b66c137eb8aa8
-
SSDEEP
24576:4LS70OsASkYS827M+8NFNzmJd+eVjW2LGLrk2WKiT:gS70OfRhxW1c2vi
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1940 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1184 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1352 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1636 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1224 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1332 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 604 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1068 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1792 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1044 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1852 752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 924 752 schtasks.exe -
Processes:
resource yara_rule behavioral1/memory/2020-54-0x0000000000FC0000-0x0000000001112000-memory.dmp dcrat behavioral1/memory/2020-58-0x000000001AE70000-0x000000001AEF0000-memory.dmp dcrat C:\MSOCache\All Users\WmiPrvSE.exe dcrat C:\MSOCache\All Users\WmiPrvSE.exe dcrat C:\MSOCache\All Users\WmiPrvSE.exe dcrat behavioral1/memory/1464-75-0x0000000001360000-0x00000000014B2000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
WmiPrvSE.exepid process 1464 WmiPrvSE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 2 IoCs
Processes:
02588099.exedescription ioc process File created C:\Program Files\Windows Sidebar\es-ES\smss.exe 02588099.exe File created C:\Program Files\Windows Sidebar\es-ES\69ddcba757bf72 02588099.exe -
Drops file in Windows directory 2 IoCs
Processes:
02588099.exedescription ioc process File created C:\Windows\inf\.NETFramework\0409\System.exe 02588099.exe File created C:\Windows\inf\.NETFramework\0409\27d1bcfc3c54e0 02588099.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1184 schtasks.exe 1352 schtasks.exe 1636 schtasks.exe 1224 schtasks.exe 1068 schtasks.exe 1792 schtasks.exe 1044 schtasks.exe 1940 schtasks.exe 924 schtasks.exe 604 schtasks.exe 1852 schtasks.exe 1332 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
02588099.exeWmiPrvSE.exepid process 2020 02588099.exe 2020 02588099.exe 2020 02588099.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe 1464 WmiPrvSE.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
02588099.exeWmiPrvSE.exedescription pid process Token: SeDebugPrivilege 2020 02588099.exe Token: SeDebugPrivilege 1464 WmiPrvSE.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WmiPrvSE.exepid process 1464 WmiPrvSE.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
02588099.exedescription pid process target process PID 2020 wrote to memory of 1464 2020 02588099.exe WmiPrvSE.exe PID 2020 wrote to memory of 1464 2020 02588099.exe WmiPrvSE.exe PID 2020 wrote to memory of 1464 2020 02588099.exe WmiPrvSE.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\02588099.exe"C:\Users\Admin\AppData\Local\Temp\02588099.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\MSOCache\All Users\WmiPrvSE.exe"C:\MSOCache\All Users\WmiPrvSE.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\inf\.NETFramework\0409\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\inf\.NETFramework\0409\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\inf\.NETFramework\0409\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\es-ES\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\es-ES\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\es-ES\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\WmiPrvSE.exeFilesize
1.3MB
MD56f6a61090a9add724eebbec1c558826b
SHA1566ea8db4bcea2d078fb71be08bc8e7003e36119
SHA256c6244c8e4e4cdecd641017d52d344b1db6a23d05fd6a8ad338c8f4f77481f483
SHA51247d88347a9082186b9667fcf3994d2fe212f09a5665cc82017d48f8833e8a67823b6b66bf3a5dbda5369dd6d1585248389e213a4b3556e8b0b0b66c137eb8aa8
-
C:\MSOCache\All Users\WmiPrvSE.exeFilesize
1.3MB
MD56f6a61090a9add724eebbec1c558826b
SHA1566ea8db4bcea2d078fb71be08bc8e7003e36119
SHA256c6244c8e4e4cdecd641017d52d344b1db6a23d05fd6a8ad338c8f4f77481f483
SHA51247d88347a9082186b9667fcf3994d2fe212f09a5665cc82017d48f8833e8a67823b6b66bf3a5dbda5369dd6d1585248389e213a4b3556e8b0b0b66c137eb8aa8
-
C:\MSOCache\All Users\WmiPrvSE.exeFilesize
1.3MB
MD56f6a61090a9add724eebbec1c558826b
SHA1566ea8db4bcea2d078fb71be08bc8e7003e36119
SHA256c6244c8e4e4cdecd641017d52d344b1db6a23d05fd6a8ad338c8f4f77481f483
SHA51247d88347a9082186b9667fcf3994d2fe212f09a5665cc82017d48f8833e8a67823b6b66bf3a5dbda5369dd6d1585248389e213a4b3556e8b0b0b66c137eb8aa8
-
memory/1464-81-0x000000001B1A0000-0x000000001B220000-memory.dmpFilesize
512KB
-
memory/1464-76-0x000000001B1A0000-0x000000001B220000-memory.dmpFilesize
512KB
-
memory/1464-75-0x0000000001360000-0x00000000014B2000-memory.dmpFilesize
1.3MB
-
memory/2020-58-0x000000001AE70000-0x000000001AEF0000-memory.dmpFilesize
512KB
-
memory/2020-60-0x00000000006F0000-0x00000000006F8000-memory.dmpFilesize
32KB
-
memory/2020-59-0x00000000004D0000-0x00000000004DE000-memory.dmpFilesize
56KB
-
memory/2020-57-0x00000000004A0000-0x00000000004B2000-memory.dmpFilesize
72KB
-
memory/2020-54-0x0000000000FC0000-0x0000000001112000-memory.dmpFilesize
1.3MB
-
memory/2020-56-0x0000000000480000-0x0000000000496000-memory.dmpFilesize
88KB
-
memory/2020-55-0x0000000000350000-0x000000000036C000-memory.dmpFilesize
112KB