Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2023, 00:17

General

  • Target

    HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe

  • Size

    608KB

  • MD5

    e8934df9ec508ad4eab478d511060d90

  • SHA1

    31582857d61047166558c92c166a6a903a09bf83

  • SHA256

    bd13041dfdb44e77eb2bc5d19ef39c05a7820010d36d2fede24d1ad330ae6daa

  • SHA512

    aecedefc6b269bfddfd9d61d91802686cfab2bea951563d2b74fb6841670f4d9e215ccab7f8953842be5a25f39dd3a034eb5cda52d54812e40f713a3465261f8

  • SSDEEP

    12288:QqnOi180YXNIIGSWAXb0ztt841j3RS/8A9rcF:Q+Oi1qNJGSnXb0zDu

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 10 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Users\Admin\AppData\Local\Temp\d8c072d3-b73b-4e14-b723-60c4a863b89f\HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe
      "C:\Users\Admin\AppData\Local\Temp\d8c072d3-b73b-4e14-b723-60c4a863b89f\HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1956
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\PerfLogs\Admin\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2756
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\d8c072d3-b73b-4e14-b723-60c4a863b89f\HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2652
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Videos\wininit.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2708
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\tapisrv\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2564
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\PerfLogs\Admin\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2700
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\C_10010\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2524
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\rtm\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2604
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2140
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Idle.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2292
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\cliconfg\services.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1416

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PerfLogs\Admin\winlogon.exe

          Filesize

          608KB

          MD5

          e8934df9ec508ad4eab478d511060d90

          SHA1

          31582857d61047166558c92c166a6a903a09bf83

          SHA256

          bd13041dfdb44e77eb2bc5d19ef39c05a7820010d36d2fede24d1ad330ae6daa

          SHA512

          aecedefc6b269bfddfd9d61d91802686cfab2bea951563d2b74fb6841670f4d9e215ccab7f8953842be5a25f39dd3a034eb5cda52d54812e40f713a3465261f8

        • C:\Users\Admin\AppData\Local\Temp\d8c072d3-b73b-4e14-b723-60c4a863b89f\HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe

          Filesize

          608KB

          MD5

          e8934df9ec508ad4eab478d511060d90

          SHA1

          31582857d61047166558c92c166a6a903a09bf83

          SHA256

          bd13041dfdb44e77eb2bc5d19ef39c05a7820010d36d2fede24d1ad330ae6daa

          SHA512

          aecedefc6b269bfddfd9d61d91802686cfab2bea951563d2b74fb6841670f4d9e215ccab7f8953842be5a25f39dd3a034eb5cda52d54812e40f713a3465261f8

        • C:\Users\Admin\AppData\Local\Temp\d8c072d3-b73b-4e14-b723-60c4a863b89f\HEUR-Trojan-Spy.MSIL.Stealer.gen-bd13041dfdb4.exe

          Filesize

          608KB

          MD5

          e8934df9ec508ad4eab478d511060d90

          SHA1

          31582857d61047166558c92c166a6a903a09bf83

          SHA256

          bd13041dfdb44e77eb2bc5d19ef39c05a7820010d36d2fede24d1ad330ae6daa

          SHA512

          aecedefc6b269bfddfd9d61d91802686cfab2bea951563d2b74fb6841670f4d9e215ccab7f8953842be5a25f39dd3a034eb5cda52d54812e40f713a3465261f8

        • memory/760-86-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

          Filesize

          9.9MB

        • memory/760-56-0x000000001AF40000-0x000000001AFC0000-memory.dmp

          Filesize

          512KB

        • memory/760-55-0x00000000002E0000-0x000000000037E000-memory.dmp

          Filesize

          632KB

        • memory/760-54-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

          Filesize

          9.9MB

        • memory/1956-83-0x0000000000E90000-0x0000000000F2E000-memory.dmp

          Filesize

          632KB

        • memory/1956-84-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

          Filesize

          9.9MB

        • memory/1956-85-0x000000001B0B0000-0x000000001B130000-memory.dmp

          Filesize

          512KB

        • memory/1956-87-0x00000000001C0000-0x00000000001CC000-memory.dmp

          Filesize

          48KB

        • memory/1956-88-0x00000000003E0000-0x00000000003EC000-memory.dmp

          Filesize

          48KB

        • memory/1956-89-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/1956-90-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

          Filesize

          9.9MB