Analysis

  • max time kernel
    188s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2023, 02:32

General

  • Target

    NEAS.93db67acc5572ee4096c1d1962766430.exe

  • Size

    783KB

  • MD5

    93db67acc5572ee4096c1d1962766430

  • SHA1

    811ef2712a3b2a757b0efcd7fdb95cdea777111d

  • SHA256

    b87a60099a45285a03886378f0786131c3fa551bd84bd6134f858703d17ab74a

  • SHA512

    cc30b4df6ed1142b4344081f1ab19abc82f3556556871e540cac9149ab70465a35cc4d9224d9664b87bc4063d5b2f9b9fdb2c493b89c400a76bd25fb0dbaf6e8

  • SSDEEP

    12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 3 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.93db67acc5572ee4096c1d1962766430.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.93db67acc5572ee4096c1d1962766430.exe"
    1⤵
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:3172
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\LayoutData\TextInputHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:312
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\System32\framedynos\backgroundTaskHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3500
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\cimdmtf\WmiPrvSE.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:888
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "NEAS.93db67acc5572ee4096c1d1962766430" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\AdobeSFX\NEAS.93db67acc5572ee4096c1d1962766430.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1648
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\ProgramData\Adobe\Setup\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4052

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\odt\System.exe

          Filesize

          783KB

          MD5

          93db67acc5572ee4096c1d1962766430

          SHA1

          811ef2712a3b2a757b0efcd7fdb95cdea777111d

          SHA256

          b87a60099a45285a03886378f0786131c3fa551bd84bd6134f858703d17ab74a

          SHA512

          cc30b4df6ed1142b4344081f1ab19abc82f3556556871e540cac9149ab70465a35cc4d9224d9664b87bc4063d5b2f9b9fdb2c493b89c400a76bd25fb0dbaf6e8

        • memory/3172-16-0x00000000025C0000-0x00000000025C8000-memory.dmp

          Filesize

          32KB

        • memory/3172-18-0x000000001ADD0000-0x000000001ADD8000-memory.dmp

          Filesize

          32KB

        • memory/3172-3-0x0000000000A30000-0x0000000000A38000-memory.dmp

          Filesize

          32KB

        • memory/3172-4-0x0000000000A40000-0x0000000000A48000-memory.dmp

          Filesize

          32KB

        • memory/3172-5-0x0000000000A50000-0x0000000000A60000-memory.dmp

          Filesize

          64KB

        • memory/3172-6-0x0000000002560000-0x0000000002568000-memory.dmp

          Filesize

          32KB

        • memory/3172-7-0x0000000002430000-0x000000000243C000-memory.dmp

          Filesize

          48KB

        • memory/3172-8-0x0000000000A60000-0x0000000000A6A000-memory.dmp

          Filesize

          40KB

        • memory/3172-9-0x0000000000A70000-0x0000000000A7A000-memory.dmp

          Filesize

          40KB

        • memory/3172-10-0x0000000002580000-0x0000000002588000-memory.dmp

          Filesize

          32KB

        • memory/3172-11-0x0000000002570000-0x0000000002578000-memory.dmp

          Filesize

          32KB

        • memory/3172-12-0x0000000002590000-0x0000000002598000-memory.dmp

          Filesize

          32KB

        • memory/3172-13-0x00000000025B0000-0x00000000025B8000-memory.dmp

          Filesize

          32KB

        • memory/3172-14-0x00000000025D0000-0x00000000025D8000-memory.dmp

          Filesize

          32KB

        • memory/3172-15-0x00000000025A0000-0x00000000025A8000-memory.dmp

          Filesize

          32KB

        • memory/3172-0-0x00000000001C0000-0x000000000028A000-memory.dmp

          Filesize

          808KB

        • memory/3172-2-0x000000001AE40000-0x000000001AE50000-memory.dmp

          Filesize

          64KB

        • memory/3172-19-0x000000001AE40000-0x000000001AE50000-memory.dmp

          Filesize

          64KB

        • memory/3172-17-0x000000001ADB0000-0x000000001ADB8000-memory.dmp

          Filesize

          32KB

        • memory/3172-21-0x000000001ADC0000-0x000000001ADC8000-memory.dmp

          Filesize

          32KB

        • memory/3172-20-0x000000001AE40000-0x000000001AE50000-memory.dmp

          Filesize

          64KB

        • memory/3172-22-0x000000001AE20000-0x000000001AE28000-memory.dmp

          Filesize

          32KB

        • memory/3172-23-0x000000001AE30000-0x000000001AE3C000-memory.dmp

          Filesize

          48KB

        • memory/3172-24-0x000000001AE40000-0x000000001AE50000-memory.dmp

          Filesize

          64KB

        • memory/3172-25-0x000000001AE50000-0x000000001AE58000-memory.dmp

          Filesize

          32KB

        • memory/3172-1-0x00007FFC61D70000-0x00007FFC62831000-memory.dmp

          Filesize

          10.8MB

        • memory/3172-38-0x00007FFC61D70000-0x00007FFC62831000-memory.dmp

          Filesize

          10.8MB

        • memory/3172-39-0x000000001AE40000-0x000000001AE50000-memory.dmp

          Filesize

          64KB

        • memory/3172-40-0x000000001AE40000-0x000000001AE50000-memory.dmp

          Filesize

          64KB

        • memory/3172-41-0x000000001AE40000-0x000000001AE50000-memory.dmp

          Filesize

          64KB

        • memory/3172-42-0x000000001AE40000-0x000000001AE50000-memory.dmp

          Filesize

          64KB

        • memory/3172-43-0x000000001AE40000-0x000000001AE50000-memory.dmp

          Filesize

          64KB

        • memory/3172-44-0x00007FFC61D70000-0x00007FFC62831000-memory.dmp

          Filesize

          10.8MB