Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2023 10:41
Static task
static1
Behavioral task
behavioral1
Sample
1daeb81d9c3201beb8ea848fd869fc80.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1daeb81d9c3201beb8ea848fd869fc80.exe
Resource
win10v2004-20230220-en
General
-
Target
1daeb81d9c3201beb8ea848fd869fc80.exe
-
Size
807KB
-
MD5
1daeb81d9c3201beb8ea848fd869fc80
-
SHA1
33aaf3d172952a169e97b4912506b08df3e01c75
-
SHA256
5d3511735bed246367c3fa97c21ce7bdc9ade8ce5212d4a40504ddc9a9330122
-
SHA512
1b998a59a2c4d746b270ba5fddd1c1000f457d627c2bef114ea6d116085004deffbfd83d0f50ad56bc1bc366b3647da2499357b704fc4a303e3bbc74f242c115
-
SSDEEP
24576:KUHKH42cH3Gz0BwDbu2fglQPvX+QZZUI1L3:KuKHGHWgIu+f+QD3
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
resource yara_rule behavioral2/memory/3688-134-0x0000000000810000-0x00000000008B4000-memory.dmp dcrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1daeb81d9c3201beb8ea848fd869fc80.exedescription pid process target process PID 3940 set thread context of 3688 3940 1daeb81d9c3201beb8ea848fd869fc80.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
AppLaunch.exepid process 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe 3688 AppLaunch.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AppLaunch.exepid process 3688 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3688 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
1daeb81d9c3201beb8ea848fd869fc80.exedescription pid process target process PID 3940 wrote to memory of 3688 3940 1daeb81d9c3201beb8ea848fd869fc80.exe AppLaunch.exe PID 3940 wrote to memory of 3688 3940 1daeb81d9c3201beb8ea848fd869fc80.exe AppLaunch.exe PID 3940 wrote to memory of 3688 3940 1daeb81d9c3201beb8ea848fd869fc80.exe AppLaunch.exe PID 3940 wrote to memory of 3688 3940 1daeb81d9c3201beb8ea848fd869fc80.exe AppLaunch.exe PID 3940 wrote to memory of 3688 3940 1daeb81d9c3201beb8ea848fd869fc80.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1daeb81d9c3201beb8ea848fd869fc80.exe"C:\Users\Admin\AppData\Local\Temp\1daeb81d9c3201beb8ea848fd869fc80.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3688-134-0x0000000000810000-0x00000000008B4000-memory.dmpFilesize
656KB
-
memory/3688-139-0x0000000005B20000-0x00000000060C4000-memory.dmpFilesize
5.6MB
-
memory/3688-140-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/3688-141-0x0000000005870000-0x00000000058C0000-memory.dmpFilesize
320KB
-
memory/3688-142-0x00000000067F0000-0x0000000006882000-memory.dmpFilesize
584KB
-
memory/3688-143-0x0000000006A00000-0x0000000006A66000-memory.dmpFilesize
408KB
-
memory/3688-179-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB