Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
07/07/2023, 19:56
Behavioral task
behavioral1
Sample
3a971964658a0bcaa170bed49.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
3a971964658a0bcaa170bed49.exe
Resource
win10v2004-20230703-en
General
-
Target
3a971964658a0bcaa170bed49.exe
-
Size
1.1MB
-
MD5
3a971964658a0bcaa170bed495b58f02
-
SHA1
13a17c7def21294f71b50db342e52685161432dc
-
SHA256
b1793fd7329055b97df5f70b7a325df0b79a132321e9d116d501fa9aaa95d4dd
-
SHA512
f94e13e6f884f841b8181b85a93c1dcaa1c4c06c5e4e158c1c4fb7cd7251ef9b8a1fe5179fdb578a255b9624e4c19f24068013bbb5490a6740f6ff9bf357dc0e
-
SSDEEP
24576:DAkqmxZDdR4L5LGwrZrD69Ug/oL8WkKWb7LnwPCsu:DA3WZDf4L5k9xOSKWnLGD
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2016 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 736 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 320 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 860 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2508 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2696 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1580 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2056 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2608 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3052 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2572 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2652 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2648 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2672 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3040 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2540 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2836 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2984 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2480 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1956 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2500 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2996 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2392 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 740 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2424 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1180 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 296 3004 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 3004 schtasks.exe 28 -
resource yara_rule behavioral1/memory/2308-54-0x0000000000CB0000-0x0000000000DD6000-memory.dmp dcrat behavioral1/files/0x0008000000014941-66.dat dcrat behavioral1/files/0x0007000000014620-83.dat dcrat behavioral1/files/0x0007000000014620-84.dat dcrat behavioral1/memory/596-85-0x0000000000C60000-0x0000000000D86000-memory.dmp dcrat behavioral1/memory/596-92-0x000000001B060000-0x000000001B0E0000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
pid Process 596 services.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Windows Journal\fr-FR\886983d96e3d3e 3a971964658a0bcaa170bed49.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\csrss.exe 3a971964658a0bcaa170bed49.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\886983d96e3d3e 3a971964658a0bcaa170bed49.exe File created C:\Program Files\Mozilla Firefox\fonts\taskhost.exe 3a971964658a0bcaa170bed49.exe File created C:\Program Files\Mozilla Firefox\fonts\b75386f1303e64 3a971964658a0bcaa170bed49.exe File created C:\Program Files\Windows Journal\fr-FR\csrss.exe 3a971964658a0bcaa170bed49.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Prefetch\lsass.exe 3a971964658a0bcaa170bed49.exe File created C:\Windows\Prefetch\6203df4a6bafc7 3a971964658a0bcaa170bed49.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 30 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2696 schtasks.exe 2984 schtasks.exe 860 schtasks.exe 3040 schtasks.exe 2540 schtasks.exe 2652 schtasks.exe 320 schtasks.exe 2040 schtasks.exe 2424 schtasks.exe 296 schtasks.exe 736 schtasks.exe 2648 schtasks.exe 2672 schtasks.exe 2500 schtasks.exe 2996 schtasks.exe 2508 schtasks.exe 1580 schtasks.exe 2056 schtasks.exe 2572 schtasks.exe 1180 schtasks.exe 2708 schtasks.exe 2016 schtasks.exe 2836 schtasks.exe 2480 schtasks.exe 2392 schtasks.exe 1480 schtasks.exe 3052 schtasks.exe 1956 schtasks.exe 740 schtasks.exe 2608 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2308 3a971964658a0bcaa170bed49.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe 596 services.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2308 3a971964658a0bcaa170bed49.exe Token: SeDebugPrivilege 596 services.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1996 2308 3a971964658a0bcaa170bed49.exe 59 PID 2308 wrote to memory of 1996 2308 3a971964658a0bcaa170bed49.exe 59 PID 2308 wrote to memory of 1996 2308 3a971964658a0bcaa170bed49.exe 59 PID 1996 wrote to memory of 2748 1996 cmd.exe 61 PID 1996 wrote to memory of 2748 1996 cmd.exe 61 PID 1996 wrote to memory of 2748 1996 cmd.exe 61 PID 1996 wrote to memory of 596 1996 cmd.exe 63 PID 1996 wrote to memory of 596 1996 cmd.exe 63 PID 1996 wrote to memory of 596 1996 cmd.exe 63 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a971964658a0bcaa170bed49.exe"C:\Users\Admin\AppData\Local\Temp\3a971964658a0bcaa170bed49.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\06uRfOfGub.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:2748
-
-
C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\services.exe"C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\services.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:596
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\NetHood\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\NetHood\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\Prefetch\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Prefetch\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3a971964658a0bcaa170bed493" /sc MINUTE /mo 11 /tr "'C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\3a971964658a0bcaa170bed49.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3a971964658a0bcaa170bed49" /sc ONLOGON /tr "'C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\3a971964658a0bcaa170bed49.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3a971964658a0bcaa170bed493" /sc MINUTE /mo 14 /tr "'C:\Recovery\3a3f43a2-19f3-11ee-a7ec-52ff6c828047\3a971964658a0bcaa170bed49.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\fr-FR\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\fr-FR\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Journal\fr-FR\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD53a971964658a0bcaa170bed495b58f02
SHA113a17c7def21294f71b50db342e52685161432dc
SHA256b1793fd7329055b97df5f70b7a325df0b79a132321e9d116d501fa9aaa95d4dd
SHA512f94e13e6f884f841b8181b85a93c1dcaa1c4c06c5e4e158c1c4fb7cd7251ef9b8a1fe5179fdb578a255b9624e4c19f24068013bbb5490a6740f6ff9bf357dc0e
-
Filesize
1.1MB
MD53a971964658a0bcaa170bed495b58f02
SHA113a17c7def21294f71b50db342e52685161432dc
SHA256b1793fd7329055b97df5f70b7a325df0b79a132321e9d116d501fa9aaa95d4dd
SHA512f94e13e6f884f841b8181b85a93c1dcaa1c4c06c5e4e158c1c4fb7cd7251ef9b8a1fe5179fdb578a255b9624e4c19f24068013bbb5490a6740f6ff9bf357dc0e
-
Filesize
226B
MD5c2a373fc5e775d17e7695a70a8ece5c5
SHA144dc8a4be7b962ab11ba0651336d74a0558c7c92
SHA256eba674cf878b4b9a5f267d64e4e17db7629fc3091c2e35ed3d310cea5d7d8a68
SHA51298d46648cd6e946f18a5de485f56af6d88fc8c00fdb9cf5d57430cb4b16c95cb7c2c23c8c26cc7866da957a646086ad90794e4faad4b96fb81a3dfe683da9d07
-
Filesize
1.1MB
MD53a971964658a0bcaa170bed495b58f02
SHA113a17c7def21294f71b50db342e52685161432dc
SHA256b1793fd7329055b97df5f70b7a325df0b79a132321e9d116d501fa9aaa95d4dd
SHA512f94e13e6f884f841b8181b85a93c1dcaa1c4c06c5e4e158c1c4fb7cd7251ef9b8a1fe5179fdb578a255b9624e4c19f24068013bbb5490a6740f6ff9bf357dc0e