Analysis
- max time kernel
138s - max time network
154s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
08/06/2023, 02:42
General
- Target 6bfbf792786f767bc33a9dc54d7b0201.bin.exe
- Size 1.2MB
- Sample230608-c61hfsbf21
- SHA256 949c549fbf47f559d9e0aa2cb247c955a1d9f35d8b7e4bcb675bd8697b081fe2
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- DCRat payload 6 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe"C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xDjfnZEh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp952F.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp952F.tmp
memory/1336-54-0x0000000000DB0000-0x0000000000EF6000-memory.dmp
memory/1336-55-0x0000000004D70000-0x0000000004DB0000-memory.dmp
memory/1336-56-0x0000000000490000-0x00000000004A4000-memory.dmp
memory/1336-57-0x0000000005DD0000-0x0000000005E94000-memory.dmp
memory/1336-58-0x00000000084F0000-0x00000000085BE000-memory.dmp
memory/1744-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1744-71-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/1744-64-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/1744-65-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/1744-63-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/1744-67-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/1744-69-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/1744-62-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/1744-72-0x00000000005B0000-0x00000000005CC000-memory.dmp
memory/1744-73-0x0000000000620000-0x0000000000636000-memory.dmp
memory/1744-74-0x0000000000650000-0x0000000000662000-memory.dmp
memory/1744-75-0x0000000000810000-0x000000000081E000-memory.dmp
memory/1744-76-0x0000000004D20000-0x0000000004D60000-memory.dmp
memory/1744-77-0x0000000004D20000-0x0000000004D60000-memory.dmp