Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    18/11/2023, 01:07

General

  • Target

    NEAS.01a66ce702b81396f987e22d5c5513a0.exe

  • Size

    783KB

  • MD5

    01a66ce702b81396f987e22d5c5513a0

  • SHA1

    007e52fa1766724d21a7305fe0f0209fb67c8fc8

  • SHA256

    b08756ce1a131b1b6037549e8133e5e0d85e4eccd3ca97242dfe9827138e0c67

  • SHA512

    a70a72d2b5f7ac3e8d08c43577257c913c054017f0c44e4bfceb308005693cfc457a7dd29d72878546f4ab8ba58b2a24632718c37e336613e18f74cda3497f16

  • SSDEEP

    12288:mqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:m+OQbpbgsFdAyQvzSqaq8q

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 9 IoCs
  • DCRat payload 7 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 12 IoCs
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.01a66ce702b81396f987e22d5c5513a0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.01a66ce702b81396f987e22d5c5513a0.exe"
    1⤵
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\NEAS.01a66ce702b81396f987e22d5c5513a0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.01a66ce702b81396f987e22d5c5513a0.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1120
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BeXS80QdQo.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          4⤵
            PID:1548
          • C:\Documents and Settings\WmiPrvSE.exe
            "C:\Documents and Settings\WmiPrvSE.exe"
            4⤵
            • UAC bypass
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • System policy modification
            PID:1260
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\odbccu32\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2864
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\explorer.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2740
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Documents and Settings\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2568
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\include\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2260
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\bin\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1368
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\pdh\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:772
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2416
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "NEAS.01a66ce702b81396f987e22d5c5513a0" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI5C30\NEAS.01a66ce702b81396f987e22d5c5513a0.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2144
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\PerfLogs\Admin\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2528
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Documents and Settings\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2100
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\PerfLogs\Admin\audiodg.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1296
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\msfeeds\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2200

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Documents and Settings\WmiPrvSE.exe

            Filesize

            783KB

            MD5

            01a66ce702b81396f987e22d5c5513a0

            SHA1

            007e52fa1766724d21a7305fe0f0209fb67c8fc8

            SHA256

            b08756ce1a131b1b6037549e8133e5e0d85e4eccd3ca97242dfe9827138e0c67

            SHA512

            a70a72d2b5f7ac3e8d08c43577257c913c054017f0c44e4bfceb308005693cfc457a7dd29d72878546f4ab8ba58b2a24632718c37e336613e18f74cda3497f16

          • C:\Program Files\Java\jdk1.7.0_80\bin\csrss.exe

            Filesize

            783KB

            MD5

            01a66ce702b81396f987e22d5c5513a0

            SHA1

            007e52fa1766724d21a7305fe0f0209fb67c8fc8

            SHA256

            b08756ce1a131b1b6037549e8133e5e0d85e4eccd3ca97242dfe9827138e0c67

            SHA512

            a70a72d2b5f7ac3e8d08c43577257c913c054017f0c44e4bfceb308005693cfc457a7dd29d72878546f4ab8ba58b2a24632718c37e336613e18f74cda3497f16

          • C:\Program Files\Java\jdk1.7.0_80\bin\csrss.exe

            Filesize

            783KB

            MD5

            0cf392f9ea23f40771d947fb9110ef83

            SHA1

            ce31df425826ee48678c1f486b6fa0630777e6f6

            SHA256

            0e750fc57f7bf6e9beb28cda4cb0dc9061bcd0ee05fcc4bf5f3e27aaf88fa73f

            SHA512

            3caefa3730f4ad652c86ffb73609978d6d0f0174fd8b17beda045164438fd30ca2858147d3b54d7af330ffe937f5ee8e88b1bce6b8571c01ced1d2776aeee5c5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            c613fdfb9df8f3675b742ebd92f7d6de

            SHA1

            662a6d81346e9fc92cd5f63fd12b4c5b3fb5db19

            SHA256

            988687a708dce151029a14fafa1883848db53e2b57b87169cccba3a44d94507e

            SHA512

            e86a15799acead92c34adf374c6e4f5b0a415442a814c7d5cfb0de58e3af30aee866ebd0a041072f774c5bd527b8324dd49f701d970bfe001f87c22cdd0e4746

          • C:\Users\Admin\AppData\Local\Temp\BeXS80QdQo.bat

            Filesize

            202B

            MD5

            51d9abcacda6f2a709ba74a80aefb282

            SHA1

            6c079cb3983192ab4d88457d641570e093ebd2d1

            SHA256

            6fbba04f76dbb9ea740c4a2968ffc71ff0f95f3073330310e7c02bb537eb9d75

            SHA512

            91ff77fbb97e98c33fcae72b7394a81916dc97cf8453b80b4195e2f5ad684f689b06dc576ae5620341aa585250ccac3b5d5c9a9e9e60bd33b045cd4e18c56a06

          • C:\Users\Admin\AppData\Local\Temp\CabDDD3.tmp

            Filesize

            61KB

            MD5

            f3441b8572aae8801c04f3060b550443

            SHA1

            4ef0a35436125d6821831ef36c28ffaf196cda15

            SHA256

            6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

            SHA512

            5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

          • C:\Users\Admin\AppData\Local\Temp\NEAS.01a66ce702b81396f987e22d5c5513a0.exe

            Filesize

            783KB

            MD5

            01a66ce702b81396f987e22d5c5513a0

            SHA1

            007e52fa1766724d21a7305fe0f0209fb67c8fc8

            SHA256

            b08756ce1a131b1b6037549e8133e5e0d85e4eccd3ca97242dfe9827138e0c67

            SHA512

            a70a72d2b5f7ac3e8d08c43577257c913c054017f0c44e4bfceb308005693cfc457a7dd29d72878546f4ab8ba58b2a24632718c37e336613e18f74cda3497f16

          • C:\Users\Admin\AppData\Local\Temp\TarDE91.tmp

            Filesize

            163KB

            MD5

            9441737383d21192400eca82fda910ec

            SHA1

            725e0d606a4fc9ba44aa8ffde65bed15e65367e4

            SHA256

            bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

            SHA512

            7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

          • C:\Users\WmiPrvSE.exe

            Filesize

            783KB

            MD5

            01a66ce702b81396f987e22d5c5513a0

            SHA1

            007e52fa1766724d21a7305fe0f0209fb67c8fc8

            SHA256

            b08756ce1a131b1b6037549e8133e5e0d85e4eccd3ca97242dfe9827138e0c67

            SHA512

            a70a72d2b5f7ac3e8d08c43577257c913c054017f0c44e4bfceb308005693cfc457a7dd29d72878546f4ab8ba58b2a24632718c37e336613e18f74cda3497f16

          • memory/1100-37-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-44-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

            Filesize

            9.9MB

          • memory/1100-6-0x0000000000250000-0x0000000000258000-memory.dmp

            Filesize

            32KB

          • memory/1100-7-0x0000000000480000-0x000000000048C000-memory.dmp

            Filesize

            48KB

          • memory/1100-8-0x00000000004A0000-0x00000000004AA000-memory.dmp

            Filesize

            40KB

          • memory/1100-9-0x0000000000470000-0x000000000047A000-memory.dmp

            Filesize

            40KB

          • memory/1100-10-0x0000000000490000-0x0000000000498000-memory.dmp

            Filesize

            32KB

          • memory/1100-11-0x0000000000460000-0x0000000000468000-memory.dmp

            Filesize

            32KB

          • memory/1100-12-0x00000000004C0000-0x00000000004C8000-memory.dmp

            Filesize

            32KB

          • memory/1100-13-0x0000000000580000-0x0000000000588000-memory.dmp

            Filesize

            32KB

          • memory/1100-14-0x00000000004D0000-0x00000000004D8000-memory.dmp

            Filesize

            32KB

          • memory/1100-17-0x00000000004E0000-0x00000000004E8000-memory.dmp

            Filesize

            32KB

          • memory/1100-16-0x0000000000730000-0x0000000000738000-memory.dmp

            Filesize

            32KB

          • memory/1100-15-0x0000000000570000-0x0000000000578000-memory.dmp

            Filesize

            32KB

          • memory/1100-18-0x0000000001F80000-0x0000000001F88000-memory.dmp

            Filesize

            32KB

          • memory/1100-19-0x0000000002090000-0x0000000002098000-memory.dmp

            Filesize

            32KB

          • memory/1100-20-0x00000000020A0000-0x00000000020A8000-memory.dmp

            Filesize

            32KB

          • memory/1100-21-0x0000000002130000-0x000000000213C000-memory.dmp

            Filesize

            48KB

          • memory/1100-22-0x00000000004B0000-0x00000000004B8000-memory.dmp

            Filesize

            32KB

          • memory/1100-23-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-34-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-35-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-36-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-4-0x0000000000230000-0x0000000000238000-memory.dmp

            Filesize

            32KB

          • memory/1100-38-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-39-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-40-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-5-0x0000000000240000-0x0000000000250000-memory.dmp

            Filesize

            64KB

          • memory/1100-45-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-52-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-53-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-68-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-69-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-83-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-84-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-87-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-89-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

            Filesize

            9.9MB

          • memory/1100-0-0x0000000000160000-0x000000000022A000-memory.dmp

            Filesize

            808KB

          • memory/1100-1-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

            Filesize

            9.9MB

          • memory/1100-2-0x000000001AF70000-0x000000001AFF0000-memory.dmp

            Filesize

            512KB

          • memory/1100-3-0x0000000000150000-0x0000000000158000-memory.dmp

            Filesize

            32KB

          • memory/1120-91-0x000000001AF50000-0x000000001AFD0000-memory.dmp

            Filesize

            512KB

          • memory/1120-115-0x000000001AF50000-0x000000001AFD0000-memory.dmp

            Filesize

            512KB

          • memory/1120-120-0x000000001AF50000-0x000000001AFD0000-memory.dmp

            Filesize

            512KB

          • memory/1120-106-0x000000001AF50000-0x000000001AFD0000-memory.dmp

            Filesize

            512KB

          • memory/1120-129-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

            Filesize

            9.9MB

          • memory/1120-88-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

            Filesize

            9.9MB

          • memory/1120-110-0x000000001AF50000-0x000000001AFD0000-memory.dmp

            Filesize

            512KB

          • memory/1120-90-0x000000001AF50000-0x000000001AFD0000-memory.dmp

            Filesize

            512KB

          • memory/1260-133-0x0000000001170000-0x000000000123A000-memory.dmp

            Filesize

            808KB

          • memory/1260-136-0x000000001AD20000-0x000000001ADA0000-memory.dmp

            Filesize

            512KB

          • memory/1260-135-0x000000001AD20000-0x000000001ADA0000-memory.dmp

            Filesize

            512KB

          • memory/1260-134-0x000000001AD20000-0x000000001ADA0000-memory.dmp

            Filesize

            512KB

          • memory/1260-132-0x000007FEF4B30000-0x000007FEF551C000-memory.dmp

            Filesize

            9.9MB

          • memory/1260-198-0x000000001AD20000-0x000000001ADA0000-memory.dmp

            Filesize

            512KB

          • memory/1260-217-0x000007FEF4B30000-0x000007FEF551C000-memory.dmp

            Filesize

            9.9MB