Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2023 03:37

General

  • Target

    HEUR-Backdoor.MSIL.LightStone.gen-48a5d085cf6.exe

  • Size

    1.1MB

  • MD5

    89eafa0c3e68136ae780afb0bed528be

  • SHA1

    8c80cb2d82eabc6a9d6bc582c0a4c67b4bc79bc3

  • SHA256

    48a5d085cf6540b1dc286bbaa17141d6c40d3aa37a6a92c6326873ca98f25e8a

  • SHA512

    e6a5a6a0602b3bb51235fee1a0a39a32327a62892635e1df7c0bc3135089718bac96ad878dabd6c8d35738a3a6595dabde716b6ebb78d17b75188b98de159e34

  • SSDEEP

    12288:o8R51UropgKt6ljehIYulIB68SzlPqGlWVKZuMM2nwLjwkidihD9+HgMVeQqn4:X1UMb6ljehI7+6X+/WpHgeeQ+4

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 11 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 11 IoCs
  • Drops file in System32 directory 18 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-48a5d085cf6.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-48a5d085cf6.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-48a5d085cf6.exe
      "C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-48a5d085cf6.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nxTpCUX1s5.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1568
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:1140
          • C:\Windows\system32\w32tm.exe
            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            4⤵
              PID:1464
            • C:\Windows\Ultimate\explorer.exe
              "C:\Windows\Ultimate\explorer.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1784
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\cmdl32\taskhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:320
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\RpcPing\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1148
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\dmvdsitf\lsm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:616
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\ProgramData\Microsoft\lsm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:112
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\wow64\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1076
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\imagehlp\lsass.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1712
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\lsm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1864
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Ultimate\explorer.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1608
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\wbiosrvc\taskhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1328
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\NlsData0019\taskhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1612
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\iasrecst\lsm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1088

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Query Registry

      1
      T1012

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nxTpCUX1s5.bat
        Filesize

        208B

        MD5

        2552aa10940419b50db2d90b473785fd

        SHA1

        098eac8649d4e19448d40f44c6bad5af9eb16940

        SHA256

        09a4e92119334acf5a0af6504f316582ba309e992703587a7d9de43afcca0bfe

        SHA512

        8c0d51185cc919d0ec3257c40b6392d609103d02855e33a082c44fe44a29b4ab9666efbe093f2174775f6ef16566b07615fbe1cb17a3709dda08f326435891b6

      • C:\Windows\System32\wow64\smss.exe
        Filesize

        1.1MB

        MD5

        89eafa0c3e68136ae780afb0bed528be

        SHA1

        8c80cb2d82eabc6a9d6bc582c0a4c67b4bc79bc3

        SHA256

        48a5d085cf6540b1dc286bbaa17141d6c40d3aa37a6a92c6326873ca98f25e8a

        SHA512

        e6a5a6a0602b3bb51235fee1a0a39a32327a62892635e1df7c0bc3135089718bac96ad878dabd6c8d35738a3a6595dabde716b6ebb78d17b75188b98de159e34

      • C:\Windows\Ultimate\explorer.exe
        Filesize

        1.1MB

        MD5

        89eafa0c3e68136ae780afb0bed528be

        SHA1

        8c80cb2d82eabc6a9d6bc582c0a4c67b4bc79bc3

        SHA256

        48a5d085cf6540b1dc286bbaa17141d6c40d3aa37a6a92c6326873ca98f25e8a

        SHA512

        e6a5a6a0602b3bb51235fee1a0a39a32327a62892635e1df7c0bc3135089718bac96ad878dabd6c8d35738a3a6595dabde716b6ebb78d17b75188b98de159e34

      • C:\Windows\Ultimate\explorer.exe
        Filesize

        1.1MB

        MD5

        89eafa0c3e68136ae780afb0bed528be

        SHA1

        8c80cb2d82eabc6a9d6bc582c0a4c67b4bc79bc3

        SHA256

        48a5d085cf6540b1dc286bbaa17141d6c40d3aa37a6a92c6326873ca98f25e8a

        SHA512

        e6a5a6a0602b3bb51235fee1a0a39a32327a62892635e1df7c0bc3135089718bac96ad878dabd6c8d35738a3a6595dabde716b6ebb78d17b75188b98de159e34

      • memory/1268-54-0x0000000000C30000-0x0000000000D4A000-memory.dmp
        Filesize

        1.1MB

      • memory/1268-55-0x000000001B010000-0x000000001B090000-memory.dmp
        Filesize

        512KB

      • memory/1784-86-0x0000000000120000-0x000000000023A000-memory.dmp
        Filesize

        1.1MB

      • memory/1784-87-0x000000001AF10000-0x000000001AF90000-memory.dmp
        Filesize

        512KB

      • memory/1792-66-0x000000001AAB0000-0x000000001AB30000-memory.dmp
        Filesize

        512KB