Analysis
-
max time kernel
96s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2023 09:01
Behavioral task
behavioral1
Sample
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe
Resource
win10v2004-20230220-en
General
-
Target
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe
-
Size
2.7MB
-
MD5
d35b5bab08ed6803970d14f007dc8ee3
-
SHA1
b9613baaf96d486ed66de01a20d5f5c033909009
-
SHA256
23e67c1d86130177dd66de26bcf6da711f4d0b7c7be298b891f6ed78aaa92f6d
-
SHA512
6c5bf98751d014991d334b808c544dcdc73f02ba207b69ec524f2b2bcdc72c24d5b2b25100d56001e03b38c4977f4d16621fc0ea78ca899f67d92deeb6e7027f
-
SSDEEP
49152:vveqMsE56Ff0uutJufj+B5PcX/OtnDTtFjnbHIJZrZBBx5QfU:vv8aFDklB5PcX/mdF7bHIJZr3Bx5M
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2512 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2228 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3684 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 312 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 348 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 780 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4936 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3672 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4212 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4320 392 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1076 392 schtasks.exe -
Processes:
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" explorer.exe -
Processes:
resource yara_rule behavioral2/memory/4236-133-0x0000000000FA0000-0x000000000124E000-memory.dmp dcrat C:\Recovery\WindowsRE\dllhost.exe dcrat C:\ProgramData\explorer.exe dcrat C:\Users\All Users\explorer.exe dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 4540 explorer.exe -
Processes:
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe -
Drops file in Program Files directory 2 IoCs
Processes:
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exedescription ioc process File created C:\Program Files\Microsoft Office 15\Idle.exe 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe File created C:\Program Files\Microsoft Office 15\6ccacd8608530f 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe -
Drops file in Windows directory 3 IoCs
Processes:
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exedescription ioc process File created C:\Windows\IME\es-ES\RuntimeBroker.exe 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe File opened for modification C:\Windows\IME\es-ES\RuntimeBroker.exe 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe File created C:\Windows\IME\es-ES\9e8d7a4ca61bd9 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2228 schtasks.exe 312 schtasks.exe 4320 schtasks.exe 3684 schtasks.exe 348 schtasks.exe 1076 schtasks.exe 4476 schtasks.exe 228 schtasks.exe 780 schtasks.exe 4936 schtasks.exe 4212 schtasks.exe 2512 schtasks.exe 4060 schtasks.exe 404 schtasks.exe 3672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exeexplorer.exepid process 4236 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe 4540 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exeexplorer.exedescription pid process Token: SeDebugPrivilege 4236 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe Token: SeDebugPrivilege 4540 explorer.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exedescription pid process target process PID 4236 wrote to memory of 4540 4236 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe explorer.exe PID 4236 wrote to memory of 4540 4236 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe explorer.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
explorer.exe23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe"C:\Users\Admin\AppData\Local\Temp\23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\All Users\explorer.exe"C:\Users\All Users\explorer.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\es-ES\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\IME\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\explorer.exeFilesize
2.7MB
MD5d35b5bab08ed6803970d14f007dc8ee3
SHA1b9613baaf96d486ed66de01a20d5f5c033909009
SHA25623e67c1d86130177dd66de26bcf6da711f4d0b7c7be298b891f6ed78aaa92f6d
SHA5126c5bf98751d014991d334b808c544dcdc73f02ba207b69ec524f2b2bcdc72c24d5b2b25100d56001e03b38c4977f4d16621fc0ea78ca899f67d92deeb6e7027f
-
C:\Recovery\WindowsRE\dllhost.exeFilesize
2.7MB
MD5d35b5bab08ed6803970d14f007dc8ee3
SHA1b9613baaf96d486ed66de01a20d5f5c033909009
SHA25623e67c1d86130177dd66de26bcf6da711f4d0b7c7be298b891f6ed78aaa92f6d
SHA5126c5bf98751d014991d334b808c544dcdc73f02ba207b69ec524f2b2bcdc72c24d5b2b25100d56001e03b38c4977f4d16621fc0ea78ca899f67d92deeb6e7027f
-
C:\Users\All Users\explorer.exeFilesize
2.7MB
MD5d35b5bab08ed6803970d14f007dc8ee3
SHA1b9613baaf96d486ed66de01a20d5f5c033909009
SHA25623e67c1d86130177dd66de26bcf6da711f4d0b7c7be298b891f6ed78aaa92f6d
SHA5126c5bf98751d014991d334b808c544dcdc73f02ba207b69ec524f2b2bcdc72c24d5b2b25100d56001e03b38c4977f4d16621fc0ea78ca899f67d92deeb6e7027f
-
memory/4236-133-0x0000000000FA0000-0x000000000124E000-memory.dmpFilesize
2.7MB
-
memory/4236-134-0x000000001C020000-0x000000001C030000-memory.dmpFilesize
64KB
-
memory/4236-135-0x0000000003350000-0x00000000033A0000-memory.dmpFilesize
320KB
-
memory/4236-136-0x000000001CB60000-0x000000001D088000-memory.dmpFilesize
5.2MB
-
memory/4236-158-0x000000001C020000-0x000000001C030000-memory.dmpFilesize
64KB
-
memory/4540-159-0x000000001B450000-0x000000001B460000-memory.dmpFilesize
64KB
-
memory/4540-160-0x000000001B450000-0x000000001B460000-memory.dmpFilesize
64KB