Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
22-01-2024 19:31
General
-
Target
z2DYSM12rQX8EmA4l5Eobd3.exe
-
Size
1.5MB
-
MD5
813189503ba0d948993203ca259d5810
-
SHA1
5553917d633963716eda6954c50a8ff0efd01cfb
-
SHA256
c4ec5d7b7a9bf60de2c201ebaca15ef8da3590033d4abc42fa402bcd2e5abd79
-
SHA512
8e46d84b7da61eed6f4b78023ed4b5deefe4324a1e1a985f46ebd496063abb5dc208f4a3008f7761b46cc9decb19846e8ea21c62b3490e6c5fb777a57ac13338
-
SSDEEP
24576:ceaMajUi+6C+mDjn7gbkFaSH7Wu4mIWGE1Sy/fBEXTHhaTEEER71RM4I13:ceaj9bHmMbkBHVdGE1Sy/ujhaIh+1
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload 7 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\z2DYSM12rQX8EmA4l5Eobd3.exe"C:\Users\Admin\AppData\Local\Temp\z2DYSM12rQX8EmA4l5Eobd3.exe"1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\spoolsv.exe"C:\Windows\system\spoolsv.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\system\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\system\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\system\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5d16ae4c3e434b3f89ca6327eff5196f8
SHA1850b8b39b219c90b650a59ef349c7c7a6f4433c5
SHA256ab1a988864ef626db0a4b121e390fc6228085aaa5fe7cc562884cdd22c23b19f
SHA51273d5c3d8eb53b41743f8cc069bdbb37600a7934ca1a2fa53d6e79bb5b039988075c2c10d55fde6fce35023c6ca36c37a2a760506947c1fddf8fc134754b2b40b
-
Filesize
1.5MB
MD51388b7a63f9144d14750c57dd45b373a
SHA1ffa085ed18a74ee0983259f5d419d41567ca68cc
SHA256289f14f229e1019bac613f7fec9f31e7cc5233cd74b1853e90fc778e4b5d79c5
SHA51285abe9f98f275a1282d98638d2a35e19d9700a9b99e3658e2f5d65bd403b90918c2660b326535b511455737e97b2f86d504e4976b3f6f37495497bc75c458ef2
-
Filesize
960KB
MD54b96ee35e87378674c32cb8de37cf815
SHA17441cfc1e9297f90c81cf28a8cae553e6084acdd
SHA256e023d1e97525d889aa68c23b495ac7f25d28cc91490fba9d0a702b2c8e85399f
SHA512762e4c638609c2c6ce62bcb6dbdc96b4fb3543cf33ce485313a7b51b3cb9a8ff051619acdefe60b6191134fd76d6773976dc3c13489e6c3da38ec8e862a833ea
-
Filesize
1.3MB
MD5e0e2e52796c6736d1602b3ceb5d91f8f
SHA103a1689e02ff0ee824e184ff46d69b9f2653a8bc
SHA256412543917c1d3757b8a7339a1eecdc05226bc0c340523f5560cc18f6b7294f31
SHA512b15583a3f214e6aa8cdfa265f8f4d5a9c345e103d74a6482743e3f75dff72fccfed1aad00c07b10368e769908b2fc50b01673273f90a14df460881ebbd14e6ce
-
Filesize
1.5MB
MD5813189503ba0d948993203ca259d5810
SHA15553917d633963716eda6954c50a8ff0efd01cfb
SHA256c4ec5d7b7a9bf60de2c201ebaca15ef8da3590033d4abc42fa402bcd2e5abd79
SHA5128e46d84b7da61eed6f4b78023ed4b5deefe4324a1e1a985f46ebd496063abb5dc208f4a3008f7761b46cc9decb19846e8ea21c62b3490e6c5fb777a57ac13338
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
1.6MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
1.6MB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
112KB
-
Filesize
512KB
-
Filesize
9.9MB