Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2023, 12:58

General

  • Target

    85e2f958f1c6843f13f7dfedf4b907168d91f33828ad4d220f9e6022c3945867.exe

  • Size

    2.0MB

  • MD5

    30187293127241c047ea7582cb3ba925

  • SHA1

    70e9d100311fcfd66e344f8a71bc1e019c3de94e

  • SHA256

    85e2f958f1c6843f13f7dfedf4b907168d91f33828ad4d220f9e6022c3945867

  • SHA512

    54f3a665d89e760f012847756ffdae0727af0617e67ae3aad59f76ce6e1e7c67ce20f52203237453a7d21f5f175f9c98281075fb182b29af4a1538312e3abd04

  • SSDEEP

    49152:nILNq8KKtRL4wk8UGHZF1ljvfvQAzjsKMvojOCIoBEScdD:nxKtRL47iPljJfsKDN7aScl

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85e2f958f1c6843f13f7dfedf4b907168d91f33828ad4d220f9e6022c3945867.exe
    "C:\Users\Admin\AppData\Local\Temp\85e2f958f1c6843f13f7dfedf4b907168d91f33828ad4d220f9e6022c3945867.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4228
    • C:\Yammi_Loader.exe
      "C:\Yammi_Loader.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4436
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CQmJXtxcMW.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2748
          • C:\Windows\SysWOW64\w32tm.exe
            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4312
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:4964

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\CQmJXtxcMW.bat

      Filesize

      228B

      MD5

      526df9a4c49c13cec115cd7fa6ebc1b1

      SHA1

      035f0ef8d044066770fc028431a6e27ad17acd08

      SHA256

      4a081a9b6ccbd4349954c2145a08cf7ff0ff07c267c3250e1c024150fc77258c

      SHA512

      eb8c626af8559d083a223892c7b7d283a18f433737021bfbcc71e93944e9b736bd716540acdc6f84f98c950df59512e71857734560f8c76b14d7b80daba87790

    • C:\Yammi_Loader.exe

      Filesize

      1.7MB

      MD5

      c91f1703dc916f794558bf40b5eab38a

      SHA1

      c020666495cb42db82515abae7cf35ca419636e9

      SHA256

      7bb4158925b3b225dbc69d2befa9cd3f9afe5ef6cf71fb581879e9df5659c5b6

      SHA512

      e345c1b4c4249cb8bc69d661564bfe9da8ee860f23e48d10d09256cd215483caf5b144040d490d43846d70e8e872b8b730dc134eda357a4e2a80991a435a6699

    • C:\Yammi_Loader.exe

      Filesize

      1.7MB

      MD5

      c91f1703dc916f794558bf40b5eab38a

      SHA1

      c020666495cb42db82515abae7cf35ca419636e9

      SHA256

      7bb4158925b3b225dbc69d2befa9cd3f9afe5ef6cf71fb581879e9df5659c5b6

      SHA512

      e345c1b4c4249cb8bc69d661564bfe9da8ee860f23e48d10d09256cd215483caf5b144040d490d43846d70e8e872b8b730dc134eda357a4e2a80991a435a6699

    • C:\Yammi_Loader.exe

      Filesize

      1.7MB

      MD5

      c91f1703dc916f794558bf40b5eab38a

      SHA1

      c020666495cb42db82515abae7cf35ca419636e9

      SHA256

      7bb4158925b3b225dbc69d2befa9cd3f9afe5ef6cf71fb581879e9df5659c5b6

      SHA512

      e345c1b4c4249cb8bc69d661564bfe9da8ee860f23e48d10d09256cd215483caf5b144040d490d43846d70e8e872b8b730dc134eda357a4e2a80991a435a6699

    • memory/1404-16-0x0000000005B30000-0x0000000005B80000-memory.dmp

      Filesize

      320KB

    • memory/1404-13-0x0000000005280000-0x0000000005290000-memory.dmp

      Filesize

      64KB

    • memory/1404-14-0x0000000005DB0000-0x0000000006354000-memory.dmp

      Filesize

      5.6MB

    • memory/1404-15-0x0000000005950000-0x000000000596C000-memory.dmp

      Filesize

      112KB

    • memory/1404-12-0x0000000074FD0000-0x0000000075780000-memory.dmp

      Filesize

      7.7MB

    • memory/1404-17-0x0000000005980000-0x0000000005996000-memory.dmp

      Filesize

      88KB

    • memory/1404-18-0x0000000005B00000-0x0000000005B0E000-memory.dmp

      Filesize

      56KB

    • memory/1404-19-0x0000000005BF0000-0x0000000005C56000-memory.dmp

      Filesize

      408KB

    • memory/1404-20-0x0000000074FD0000-0x0000000075780000-memory.dmp

      Filesize

      7.7MB

    • memory/1404-21-0x0000000005280000-0x0000000005290000-memory.dmp

      Filesize

      64KB

    • memory/1404-22-0x0000000006860000-0x00000000068F2000-memory.dmp

      Filesize

      584KB

    • memory/1404-55-0x0000000074FD0000-0x0000000075780000-memory.dmp

      Filesize

      7.7MB

    • memory/1404-11-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB