Analysis

  • max time kernel
    118s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    18/11/2023, 02:37

General

  • Target

    NEAS.d316c5acd7974aaa1cab464245b38ac0.exe

  • Size

    783KB

  • MD5

    d316c5acd7974aaa1cab464245b38ac0

  • SHA1

    9c7636717bb1063e0801a769aeef01bf15af1bb4

  • SHA256

    b55e235214350f8fe2b3e870aa318e1eefc3cbf7c29f4109e7944e32bb99d43d

  • SHA512

    c1251f6f48c716f167842262de085290f8aaff08ee4f676f8d47424ca2020326bf0b49a0c700e6b373c4200c5a4b4ca8b2f0105c2dccab74c4a4308b46d59a4b

  • SSDEEP

    12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 7 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in System32 directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.d316c5acd7974aaa1cab464245b38ac0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.d316c5acd7974aaa1cab464245b38ac0.exe"
    1⤵
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2172
    • C:\Windows\System32\l_intl\spoolsv.exe
      "C:\Windows\System32\l_intl\spoolsv.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:2140
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\KBDMAC\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2536
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\l_intl\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2508
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\Groupinghc\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2984
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\73725a82-739a-11ee-b301-ca9cbbc363d2\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2476

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          f01e350e566149df05621aa227fb2f52

          SHA1

          32f5b2eda5c27cf2291b548d40534b91cb8a908d

          SHA256

          d167d8873aa83d7a67493803a08cde3d7e4cc8f573f1bb883323f34233c59bb0

          SHA512

          43a58a68c97e10733f734f7c2177795f0730598a86bbb32510410612cfae4a320cb00f55a3ec7a093a268874874e046f65471e8eb688cc05703576930a77b061

        • C:\Users\Admin\AppData\Local\Temp\Cab9262.tmp

          Filesize

          61KB

          MD5

          f3441b8572aae8801c04f3060b550443

          SHA1

          4ef0a35436125d6821831ef36c28ffaf196cda15

          SHA256

          6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

          SHA512

          5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

        • C:\Users\Admin\AppData\Local\Temp\Tar92D2.tmp

          Filesize

          163KB

          MD5

          9441737383d21192400eca82fda910ec

          SHA1

          725e0d606a4fc9ba44aa8ffde65bed15e65367e4

          SHA256

          bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

          SHA512

          7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

        • C:\Windows\System32\KBDMAC\winlogon.exe

          Filesize

          783KB

          MD5

          d316c5acd7974aaa1cab464245b38ac0

          SHA1

          9c7636717bb1063e0801a769aeef01bf15af1bb4

          SHA256

          b55e235214350f8fe2b3e870aa318e1eefc3cbf7c29f4109e7944e32bb99d43d

          SHA512

          c1251f6f48c716f167842262de085290f8aaff08ee4f676f8d47424ca2020326bf0b49a0c700e6b373c4200c5a4b4ca8b2f0105c2dccab74c4a4308b46d59a4b

        • C:\Windows\System32\l_intl\spoolsv.exe

          Filesize

          783KB

          MD5

          fcbdf31839b54fa1f1d745db24c485ab

          SHA1

          22bed2c4fee7ad87303f79741a15a8b3b4c98388

          SHA256

          3f86495e050f5bf16c59feea3146c5cf69a1aa77768ade06672f4d6ec6ec4112

          SHA512

          5c8a084029745262fb624bdea8498f8fa86c503a06db34da4996dc36c0ffd13f82f958e68eabd25e241f691e5a91df90941c66e1ab9f790dfe32b403e053fed2

        • C:\Windows\System32\l_intl\spoolsv.exe

          Filesize

          783KB

          MD5

          fcbdf31839b54fa1f1d745db24c485ab

          SHA1

          22bed2c4fee7ad87303f79741a15a8b3b4c98388

          SHA256

          3f86495e050f5bf16c59feea3146c5cf69a1aa77768ade06672f4d6ec6ec4112

          SHA512

          5c8a084029745262fb624bdea8498f8fa86c503a06db34da4996dc36c0ffd13f82f958e68eabd25e241f691e5a91df90941c66e1ab9f790dfe32b403e053fed2

        • C:\Windows\System32\l_intl\spoolsv.exe

          Filesize

          783KB

          MD5

          fcbdf31839b54fa1f1d745db24c485ab

          SHA1

          22bed2c4fee7ad87303f79741a15a8b3b4c98388

          SHA256

          3f86495e050f5bf16c59feea3146c5cf69a1aa77768ade06672f4d6ec6ec4112

          SHA512

          5c8a084029745262fb624bdea8498f8fa86c503a06db34da4996dc36c0ffd13f82f958e68eabd25e241f691e5a91df90941c66e1ab9f790dfe32b403e053fed2

        • memory/2140-76-0x000000001B130000-0x000000001B1B0000-memory.dmp

          Filesize

          512KB

        • memory/2140-73-0x000000001B130000-0x000000001B1B0000-memory.dmp

          Filesize

          512KB

        • memory/2140-72-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

          Filesize

          9.9MB

        • memory/2140-71-0x0000000000960000-0x0000000000A2A000-memory.dmp

          Filesize

          808KB

        • memory/2140-75-0x000000001B130000-0x000000001B1B0000-memory.dmp

          Filesize

          512KB

        • memory/2140-104-0x000000001B130000-0x000000001B1B0000-memory.dmp

          Filesize

          512KB

        • memory/2140-167-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

          Filesize

          9.9MB

        • memory/2172-10-0x0000000000430000-0x0000000000438000-memory.dmp

          Filesize

          32KB

        • memory/2172-63-0x0000000000D20000-0x0000000000DA0000-memory.dmp

          Filesize

          512KB

        • memory/2172-17-0x0000000000560000-0x0000000000568000-memory.dmp

          Filesize

          32KB

        • memory/2172-15-0x00000000004B0000-0x00000000004B8000-memory.dmp

          Filesize

          32KB

        • memory/2172-18-0x00000000004D0000-0x00000000004D8000-memory.dmp

          Filesize

          32KB

        • memory/2172-19-0x0000000000480000-0x0000000000488000-memory.dmp

          Filesize

          32KB

        • memory/2172-20-0x0000000000570000-0x0000000000578000-memory.dmp

          Filesize

          32KB

        • memory/2172-21-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

          Filesize

          48KB

        • memory/2172-22-0x0000000002370000-0x0000000002378000-memory.dmp

          Filesize

          32KB

        • memory/2172-23-0x0000000000D20000-0x0000000000DA0000-memory.dmp

          Filesize

          512KB

        • memory/2172-32-0x0000000000D20000-0x0000000000DA0000-memory.dmp

          Filesize

          512KB

        • memory/2172-36-0x0000000000D20000-0x0000000000DA0000-memory.dmp

          Filesize

          512KB

        • memory/2172-14-0x0000000000490000-0x0000000000498000-memory.dmp

          Filesize

          32KB

        • memory/2172-49-0x0000000000D20000-0x0000000000DA0000-memory.dmp

          Filesize

          512KB

        • memory/2172-13-0x0000000000470000-0x0000000000478000-memory.dmp

          Filesize

          32KB

        • memory/2172-16-0x00000000004C0000-0x00000000004C8000-memory.dmp

          Filesize

          32KB

        • memory/2172-12-0x0000000000450000-0x0000000000458000-memory.dmp

          Filesize

          32KB

        • memory/2172-11-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2172-0-0x0000000000DE0000-0x0000000000EAA000-memory.dmp

          Filesize

          808KB

        • memory/2172-9-0x0000000000410000-0x000000000041A000-memory.dmp

          Filesize

          40KB

        • memory/2172-8-0x0000000000440000-0x000000000044A000-memory.dmp

          Filesize

          40KB

        • memory/2172-74-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

          Filesize

          9.9MB

        • memory/2172-7-0x0000000000420000-0x000000000042C000-memory.dmp

          Filesize

          48KB

        • memory/2172-6-0x00000000003F0000-0x00000000003F8000-memory.dmp

          Filesize

          32KB

        • memory/2172-5-0x00000000003E0000-0x00000000003F0000-memory.dmp

          Filesize

          64KB

        • memory/2172-4-0x00000000003D0000-0x00000000003D8000-memory.dmp

          Filesize

          32KB

        • memory/2172-3-0x00000000001D0000-0x00000000001D8000-memory.dmp

          Filesize

          32KB

        • memory/2172-2-0x0000000000D20000-0x0000000000DA0000-memory.dmp

          Filesize

          512KB

        • memory/2172-1-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

          Filesize

          9.9MB