Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 02:41

General

  • Target

    dd0a4243de09c5864297da95ddc1362c.exe

  • Size

    1.6MB

  • MD5

    dd0a4243de09c5864297da95ddc1362c

  • SHA1

    e91545cf645d3987e44d657bd37b79a2cd7515d4

  • SHA256

    23a9505d97a5c7c3ac76901f21e72ca79d0aa56393c3e9e13f30f5286431f1cc

  • SHA512

    b0ae4c48264051823bd74167c42e4071d189394b77b664f333c872f8ff8d20dddf26b2dc64efb013bf735d5accac2e38f340079c23c53196709eed9765123901

  • SSDEEP

    24576:i2G/nvxW3WyZRE4c3f7LcJVCsjTcgucZDlx7HZHb40W00l6g+4V:ibA3NELx+0lGe

Malware Config

Signatures

  • DcRat 7 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd0a4243de09c5864297da95ddc1362c.exe
    "C:\Users\Admin\AppData\Local\Temp\dd0a4243de09c5864297da95ddc1362c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Monitornetdhcpcommon\qTMy7tKgcv8HK3o1cT.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Monitornetdhcpcommon\UMkN4Z1.bat" "
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Monitornetdhcpcommon\MonitornetdhcpcommonRefhostDll.exe
          "C:\Monitornetdhcpcommon\MonitornetdhcpcommonRefhostDll.exe"
          4⤵
          • DcRat
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2428
          • C:\Program Files\Windows Media Player\winlogon.exe
            "C:\Program Files\Windows Media Player\winlogon.exe"
            5⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2784
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\sppwmi\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2416
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2544
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\SysWOW64\setup16\cmd.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1276
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\PerfLogs\Admin\services.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2720
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Monitornetdhcpcommon\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2732
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\EhStorAPI\csrss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2512

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Monitornetdhcpcommon\UMkN4Z1.bat

          Filesize

          60B

          MD5

          48a60762b79ad9f6a6243ac662713ce2

          SHA1

          b0adb833ec22168c21022ff4a9da743d2803dace

          SHA256

          7125fce7974bcb82ed25158d6df05502444032b5ee3dbd632b9688ea0aa3d4c4

          SHA512

          f26f35f69fd8fe4c83cad1e06cb5e0451654f6890242f4781a83d74c79d36116dd802e71f2914664d2858ac43a08ecec2fcabdd29093b8f40e03b79f30059cb3

        • C:\Monitornetdhcpcommon\qTMy7tKgcv8HK3o1cT.vbe

          Filesize

          204B

          MD5

          bf3d7f76563cab7463d7af23eae9806d

          SHA1

          c5bf0526d8815d1223a1fd7919872ab22fb0d86c

          SHA256

          90d824616f4cfb00b38f8787620d092ece7fec348c788d4cafd4a37e30abe194

          SHA512

          7020295c2f35b05297f432b387ae50fb884ba7eb856f333cf5dc16c2d779b11a1a64bdf7c4abdc974666e6225dc7824e6e45c6bc258519a0a5baaf95619ac430

        • \Monitornetdhcpcommon\MonitornetdhcpcommonRefhostDll.exe

          Filesize

          1.3MB

          MD5

          5403717e99762e8c0e9cc5e97c74473c

          SHA1

          3405db3bab54365efb29172f061dc461a43f9da3

          SHA256

          c282d6ab229dbc8f26ebe56d64db0c5ac2721a8d0d3d3f915563d125cccbbb4b

          SHA512

          334b4da3b0a8c92d1f10ddaae473379a0ed966e699d45aa57240c37464f3f30488375376d447f0e6ab621fa92337a79f95ca387dbb72e337565f0a9eda0400a3

        • memory/2428-34-0x000007FEF6010000-0x000007FEF69FC000-memory.dmp

          Filesize

          9.9MB

        • memory/2428-13-0x0000000000340000-0x000000000048E000-memory.dmp

          Filesize

          1.3MB

        • memory/2428-14-0x000007FEF6010000-0x000007FEF69FC000-memory.dmp

          Filesize

          9.9MB

        • memory/2428-15-0x0000000000690000-0x0000000000710000-memory.dmp

          Filesize

          512KB

        • memory/2784-42-0x0000000000410000-0x000000000041A000-memory.dmp

          Filesize

          40KB

        • memory/2784-46-0x00000000004B0000-0x00000000004B8000-memory.dmp

          Filesize

          32KB

        • memory/2784-37-0x000000001AFF0000-0x000000001B070000-memory.dmp

          Filesize

          512KB

        • memory/2784-38-0x0000000000350000-0x0000000000358000-memory.dmp

          Filesize

          32KB

        • memory/2784-39-0x0000000000370000-0x0000000000378000-memory.dmp

          Filesize

          32KB

        • memory/2784-40-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2784-41-0x00000000004A0000-0x00000000004AC000-memory.dmp

          Filesize

          48KB

        • memory/2784-36-0x00000000008F0000-0x0000000000A3E000-memory.dmp

          Filesize

          1.3MB

        • memory/2784-43-0x00000000004C0000-0x00000000004C8000-memory.dmp

          Filesize

          32KB

        • memory/2784-44-0x00000000004D0000-0x00000000004D8000-memory.dmp

          Filesize

          32KB

        • memory/2784-45-0x00000000004E0000-0x00000000004E8000-memory.dmp

          Filesize

          32KB

        • memory/2784-35-0x000007FEF6010000-0x000007FEF69FC000-memory.dmp

          Filesize

          9.9MB

        • memory/2784-48-0x00000000004F0000-0x00000000004F8000-memory.dmp

          Filesize

          32KB

        • memory/2784-49-0x0000000000500000-0x0000000000508000-memory.dmp

          Filesize

          32KB

        • memory/2784-50-0x0000000000510000-0x0000000000518000-memory.dmp

          Filesize

          32KB

        • memory/2784-51-0x0000000000520000-0x0000000000528000-memory.dmp

          Filesize

          32KB

        • memory/2784-52-0x0000000000580000-0x0000000000588000-memory.dmp

          Filesize

          32KB

        • memory/2784-53-0x0000000000530000-0x0000000000538000-memory.dmp

          Filesize

          32KB

        • memory/2784-54-0x0000000000540000-0x0000000000548000-memory.dmp

          Filesize

          32KB

        • memory/2784-55-0x0000000000550000-0x0000000000558000-memory.dmp

          Filesize

          32KB

        • memory/2784-56-0x000000001AFF0000-0x000000001B070000-memory.dmp

          Filesize

          512KB

        • memory/2784-57-0x000000001AFF0000-0x000000001B070000-memory.dmp

          Filesize

          512KB

        • memory/2784-58-0x000000001AFF0000-0x000000001B070000-memory.dmp

          Filesize

          512KB

        • memory/2784-59-0x000007FEF6010000-0x000007FEF69FC000-memory.dmp

          Filesize

          9.9MB