Analysis
- max time kernel
92s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
23/01/2024, 01:26
General
- Target jCyHhpaWZuPt1gwyR4RFxVkP6zWke.exe
- Size 1.5MB
- Sample240123-bthw7sfcg6
- SHA256 486a172f5e53e60a401aafcd42ea3ff43474f7fc728408fbcc74993e3327a823
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- DCRat payload 4 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Drops file in Drivers directory 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 11 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jCyHhpaWZuPt1gwyR4RFxVkP6zWke.exe"C:\Users\Admin\AppData\Local\Temp\jCyHhpaWZuPt1gwyR4RFxVkP6zWke.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GQh003RWFi.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Admin\PrintHood\RuntimeBroker.exe"C:\Users\Admin\PrintHood\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\PrintHood\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\PrintHood\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
GQh003RWFi.bat
RCX5BFC.tmp
RuntimeBroker.exe
RuntimeBroker.exe
memory/2116-13-0x00000000028A0000-0x00000000028AE000-memory.dmp
memory/2116-17-0x000000001B440000-0x000000001B44C000-memory.dmp
memory/2116-9-0x0000000002870000-0x0000000002878000-memory.dmp
memory/2116-12-0x0000000002890000-0x000000000289C000-memory.dmp
memory/2116-11-0x0000000002880000-0x0000000002888000-memory.dmp
memory/2116-8-0x00000000010B0000-0x00000000010C0000-memory.dmp
memory/2116-7-0x0000000001090000-0x00000000010A6000-memory.dmp
memory/2116-3-0x0000000001070000-0x000000000108C000-memory.dmp
memory/2116-0-0x0000000000560000-0x00000000006EE000-memory.dmp
memory/2116-14-0x000000001B430000-0x000000001B440000-memory.dmp
memory/2116-16-0x000000001B430000-0x000000001B440000-memory.dmp
memory/2116-4-0x00000000028C0000-0x0000000002910000-memory.dmp
memory/2116-18-0x000000001B450000-0x000000001B458000-memory.dmp
memory/2116-19-0x000000001B460000-0x000000001B46A000-memory.dmp
memory/2116-15-0x00000000028B0000-0x00000000028B8000-memory.dmp
memory/2116-24-0x000000001B430000-0x000000001B440000-memory.dmp
memory/2116-5-0x0000000000CB0000-0x0000000000CB8000-memory.dmp
memory/2116-74-0x00007FFB14240000-0x00007FFB14D01000-memory.dmp
memory/2116-6-0x0000000001010000-0x0000000001020000-memory.dmp
memory/2116-2-0x000000001B430000-0x000000001B440000-memory.dmp
memory/2116-1-0x00007FFB14240000-0x00007FFB14D01000-memory.dmp
memory/3520-79-0x00007FFB14240000-0x00007FFB14D01000-memory.dmp
memory/3520-81-0x00007FFB14240000-0x00007FFB14D01000-memory.dmp