Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    18/11/2023, 05:49

General

  • Target

    NEAS.8a3f7accb656f787354b8280323176a0.exe

  • Size

    783KB

  • MD5

    8a3f7accb656f787354b8280323176a0

  • SHA1

    c9544d9107ed710954bf4b575598cc392d567f26

  • SHA256

    32b2a8994267885e9c2e1b70dfe03a088e45714f90f9aab8c5c89649dba6b80f

  • SHA512

    c81e198a992c469d5e533cc35a7604fc00097b2c2d4bf0ebed85487f4d9708c8adca543ebf11963d464e007379bc7e62a00bdca84d7dec79b7cefbaa9775bb7e

  • SSDEEP

    12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.8a3f7accb656f787354b8280323176a0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.8a3f7accb656f787354b8280323176a0.exe"
    1⤵
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2580
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DgVfj2ze01.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1364
        • C:\Windows\mib\explorer.exe
          "C:\Windows\mib\explorer.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:1496
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\PerfLogs\Admin\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2552
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\mib\explorer.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2540
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\8085ef82-71fa-11ee-8ff5-ea7cdd3ca6eb\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2548
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\ProgramData\Desktop\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2476
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:588
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\comcat\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2836

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exe

            Filesize

            783KB

            MD5

            8a3f7accb656f787354b8280323176a0

            SHA1

            c9544d9107ed710954bf4b575598cc392d567f26

            SHA256

            32b2a8994267885e9c2e1b70dfe03a088e45714f90f9aab8c5c89649dba6b80f

            SHA512

            c81e198a992c469d5e533cc35a7604fc00097b2c2d4bf0ebed85487f4d9708c8adca543ebf11963d464e007379bc7e62a00bdca84d7dec79b7cefbaa9775bb7e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            25f3e186d36910937cf94dfc62865d97

            SHA1

            e4e1e0fbf599837dcf9f30175e9a2e8ac14543d1

            SHA256

            24a96b16046d01cd380a3a6a617dde78968ae6628a9033f3fe18c697c730e5d4

            SHA512

            c85a185e216791211982e67e9ec7c2bde78c3db2650be34905bbb5a5964cad783180bdc0596ecf5bd780b924e30f199e1f4093b511d833efbb5be8d32dc6ed00

          • C:\Users\Admin\AppData\Local\Temp\Cab88B2.tmp

            Filesize

            61KB

            MD5

            f3441b8572aae8801c04f3060b550443

            SHA1

            4ef0a35436125d6821831ef36c28ffaf196cda15

            SHA256

            6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

            SHA512

            5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

          • C:\Users\Admin\AppData\Local\Temp\DgVfj2ze01.bat

            Filesize

            191B

            MD5

            942352f680718d05661a18d0607b050e

            SHA1

            b9034e7a47dc210273d8cc296d99c381a6a17087

            SHA256

            ee9dab0179014e9f2695c7056b43d1497591196c01d9a6ef2ddaaf94df18091d

            SHA512

            998229c76c964be5c6b79f38d5138e90f5ce2f5dc54353cfe1b4df32720ccb89909fab1c403e8e570bbd57186b76614de7b3fdf506a4aeea76785db142c5b545

          • C:\Users\Admin\AppData\Local\Temp\Tar8922.tmp

            Filesize

            163KB

            MD5

            9441737383d21192400eca82fda910ec

            SHA1

            725e0d606a4fc9ba44aa8ffde65bed15e65367e4

            SHA256

            bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

            SHA512

            7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

          • C:\Windows\mib\explorer.exe

            Filesize

            783KB

            MD5

            8a3f7accb656f787354b8280323176a0

            SHA1

            c9544d9107ed710954bf4b575598cc392d567f26

            SHA256

            32b2a8994267885e9c2e1b70dfe03a088e45714f90f9aab8c5c89649dba6b80f

            SHA512

            c81e198a992c469d5e533cc35a7604fc00097b2c2d4bf0ebed85487f4d9708c8adca543ebf11963d464e007379bc7e62a00bdca84d7dec79b7cefbaa9775bb7e

          • C:\Windows\mib\explorer.exe

            Filesize

            783KB

            MD5

            8a3f7accb656f787354b8280323176a0

            SHA1

            c9544d9107ed710954bf4b575598cc392d567f26

            SHA256

            32b2a8994267885e9c2e1b70dfe03a088e45714f90f9aab8c5c89649dba6b80f

            SHA512

            c81e198a992c469d5e533cc35a7604fc00097b2c2d4bf0ebed85487f4d9708c8adca543ebf11963d464e007379bc7e62a00bdca84d7dec79b7cefbaa9775bb7e

          • memory/1496-97-0x000000001AFD0000-0x000000001B050000-memory.dmp

            Filesize

            512KB

          • memory/1496-95-0x000000001AFD0000-0x000000001B050000-memory.dmp

            Filesize

            512KB

          • memory/1496-94-0x000007FEF4C80000-0x000007FEF566C000-memory.dmp

            Filesize

            9.9MB

          • memory/1496-93-0x0000000000D10000-0x0000000000DDA000-memory.dmp

            Filesize

            808KB

          • memory/1496-96-0x000000001AFD0000-0x000000001B050000-memory.dmp

            Filesize

            512KB

          • memory/1496-177-0x000000001AFD0000-0x000000001B050000-memory.dmp

            Filesize

            512KB

          • memory/1496-178-0x000007FEF4C80000-0x000007FEF566C000-memory.dmp

            Filesize

            9.9MB

          • memory/2580-11-0x0000000000730000-0x0000000000738000-memory.dmp

            Filesize

            32KB

          • memory/2580-83-0x000000001AEC0000-0x000000001AF40000-memory.dmp

            Filesize

            512KB

          • memory/2580-16-0x00000000007C0000-0x00000000007C8000-memory.dmp

            Filesize

            32KB

          • memory/2580-15-0x00000000007A0000-0x00000000007A8000-memory.dmp

            Filesize

            32KB

          • memory/2580-18-0x00000000007F0000-0x00000000007F8000-memory.dmp

            Filesize

            32KB

          • memory/2580-19-0x0000000000D50000-0x0000000000D58000-memory.dmp

            Filesize

            32KB

          • memory/2580-20-0x0000000000D60000-0x0000000000D68000-memory.dmp

            Filesize

            32KB

          • memory/2580-21-0x00000000007E0000-0x00000000007EC000-memory.dmp

            Filesize

            48KB

          • memory/2580-22-0x0000000000750000-0x0000000000758000-memory.dmp

            Filesize

            32KB

          • memory/2580-23-0x000000001AEC0000-0x000000001AF40000-memory.dmp

            Filesize

            512KB

          • memory/2580-14-0x00000000007B0000-0x00000000007B8000-memory.dmp

            Filesize

            32KB

          • memory/2580-36-0x000000001AEC0000-0x000000001AF40000-memory.dmp

            Filesize

            512KB

          • memory/2580-46-0x000000001AEC0000-0x000000001AF40000-memory.dmp

            Filesize

            512KB

          • memory/2580-54-0x000000001AEC0000-0x000000001AF40000-memory.dmp

            Filesize

            512KB

          • memory/2580-69-0x000000001AEC0000-0x000000001AF40000-memory.dmp

            Filesize

            512KB

          • memory/2580-17-0x00000000007D0000-0x00000000007D8000-memory.dmp

            Filesize

            32KB

          • memory/2580-89-0x000007FEF5670000-0x000007FEF605C000-memory.dmp

            Filesize

            9.9MB

          • memory/2580-13-0x0000000000780000-0x0000000000788000-memory.dmp

            Filesize

            32KB

          • memory/2580-12-0x0000000000740000-0x0000000000748000-memory.dmp

            Filesize

            32KB

          • memory/2580-0-0x0000000000E80000-0x0000000000F4A000-memory.dmp

            Filesize

            808KB

          • memory/2580-10-0x00000000004B0000-0x00000000004B8000-memory.dmp

            Filesize

            32KB

          • memory/2580-9-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

          • memory/2580-8-0x0000000000490000-0x000000000049A000-memory.dmp

            Filesize

            40KB

          • memory/2580-7-0x00000000004A0000-0x00000000004AC000-memory.dmp

            Filesize

            48KB

          • memory/2580-6-0x00000000003F0000-0x00000000003F8000-memory.dmp

            Filesize

            32KB

          • memory/2580-5-0x00000000003E0000-0x00000000003F0000-memory.dmp

            Filesize

            64KB

          • memory/2580-4-0x00000000001E0000-0x00000000001E8000-memory.dmp

            Filesize

            32KB

          • memory/2580-3-0x00000000001D0000-0x00000000001D8000-memory.dmp

            Filesize

            32KB

          • memory/2580-2-0x000000001AEC0000-0x000000001AF40000-memory.dmp

            Filesize

            512KB

          • memory/2580-1-0x000007FEF5670000-0x000007FEF605C000-memory.dmp

            Filesize

            9.9MB