Analysis

  • max time kernel
    145s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 02:41

General

  • Target

    dd0a4243de09c5864297da95ddc1362c.exe

  • Size

    1.6MB

  • MD5

    dd0a4243de09c5864297da95ddc1362c

  • SHA1

    e91545cf645d3987e44d657bd37b79a2cd7515d4

  • SHA256

    23a9505d97a5c7c3ac76901f21e72ca79d0aa56393c3e9e13f30f5286431f1cc

  • SHA512

    b0ae4c48264051823bd74167c42e4071d189394b77b664f333c872f8ff8d20dddf26b2dc64efb013bf735d5accac2e38f340079c23c53196709eed9765123901

  • SSDEEP

    24576:i2G/nvxW3WyZRE4c3f7LcJVCsjTcgucZDlx7HZHb40W00l6g+4V:ibA3NELx+0lGe

Malware Config

Signatures

  • DcRat 7 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd0a4243de09c5864297da95ddc1362c.exe
    "C:\Users\Admin\AppData\Local\Temp\dd0a4243de09c5864297da95ddc1362c.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Monitornetdhcpcommon\qTMy7tKgcv8HK3o1cT.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Monitornetdhcpcommon\UMkN4Z1.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Monitornetdhcpcommon\MonitornetdhcpcommonRefhostDll.exe
          "C:\Monitornetdhcpcommon\MonitornetdhcpcommonRefhostDll.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4228
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2CqMyoSWPb.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2748
            • C:\Windows\system32\chcp.com
              chcp 65001
              6⤵
                PID:4900
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                6⤵
                  PID:4332
                • C:\Monitornetdhcpcommon\UMkN4Z1\MonitornetdhcpcommonRefhostDll.exe
                  "C:\Monitornetdhcpcommon\UMkN4Z1\MonitornetdhcpcommonRefhostDll.exe"
                  6⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4420
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4492
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\msedge.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2112
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\polstore\fontdrvhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3484
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "MonitornetdhcpcommonRefhostDll" /sc ONLOGON /tr "'C:\Monitornetdhcpcommon\UMkN4Z1\MonitornetdhcpcommonRefhostDll.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3420
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3160
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\taskhostw.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3144
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2232,i,3915538061666887171,15629965885515244134,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4956

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Monitornetdhcpcommon\MonitornetdhcpcommonRefhostDll.exe

                Filesize

                1.3MB

                MD5

                5403717e99762e8c0e9cc5e97c74473c

                SHA1

                3405db3bab54365efb29172f061dc461a43f9da3

                SHA256

                c282d6ab229dbc8f26ebe56d64db0c5ac2721a8d0d3d3f915563d125cccbbb4b

                SHA512

                334b4da3b0a8c92d1f10ddaae473379a0ed966e699d45aa57240c37464f3f30488375376d447f0e6ab621fa92337a79f95ca387dbb72e337565f0a9eda0400a3

              • C:\Monitornetdhcpcommon\UMkN4Z1.bat

                Filesize

                60B

                MD5

                48a60762b79ad9f6a6243ac662713ce2

                SHA1

                b0adb833ec22168c21022ff4a9da743d2803dace

                SHA256

                7125fce7974bcb82ed25158d6df05502444032b5ee3dbd632b9688ea0aa3d4c4

                SHA512

                f26f35f69fd8fe4c83cad1e06cb5e0451654f6890242f4781a83d74c79d36116dd802e71f2914664d2858ac43a08ecec2fcabdd29093b8f40e03b79f30059cb3

              • C:\Monitornetdhcpcommon\qTMy7tKgcv8HK3o1cT.vbe

                Filesize

                204B

                MD5

                bf3d7f76563cab7463d7af23eae9806d

                SHA1

                c5bf0526d8815d1223a1fd7919872ab22fb0d86c

                SHA256

                90d824616f4cfb00b38f8787620d092ece7fec348c788d4cafd4a37e30abe194

                SHA512

                7020295c2f35b05297f432b387ae50fb884ba7eb856f333cf5dc16c2d779b11a1a64bdf7c4abdc974666e6225dc7824e6e45c6bc258519a0a5baaf95619ac430

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MonitornetdhcpcommonRefhostDll.exe.log

                Filesize

                1KB

                MD5

                b7c0c43fc7804baaa7dc87152cdc9554

                SHA1

                1bab62bd56af745678d4e967d91e1ccfdeed4038

                SHA256

                46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457

                SHA512

                9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769

              • C:\Users\Admin\AppData\Local\Temp\2CqMyoSWPb.bat

                Filesize

                282B

                MD5

                1e56262fdece41c68476bcc2a877d541

                SHA1

                9e6d4b8f328212ce0ed18b7371115e79849b10d7

                SHA256

                7379e79f3e4d049a6e48965ae153758e9928cfa6d9eaf27c7ee15a09b5b2fe74

                SHA512

                b0b43aaf0a8d7e8cca3a88a6f7ce6a84995ea75994215e18a4d7ebeddde737453033c7f04a7be9b0894c04a8633ddec75dd29f5e27de9062017f93e2d5fc59b7

              • memory/4228-12-0x0000000000E70000-0x0000000000FBE000-memory.dmp

                Filesize

                1.3MB

              • memory/4228-13-0x00007FF8D3190000-0x00007FF8D3C51000-memory.dmp

                Filesize

                10.8MB

              • memory/4228-14-0x000000001BD00000-0x000000001BD10000-memory.dmp

                Filesize

                64KB

              • memory/4228-32-0x00007FF8D3190000-0x00007FF8D3C51000-memory.dmp

                Filesize

                10.8MB

              • memory/4420-45-0x000000001B230000-0x000000001B238000-memory.dmp

                Filesize

                32KB

              • memory/4420-49-0x000000001B280000-0x000000001B288000-memory.dmp

                Filesize

                32KB

              • memory/4420-40-0x00000000028F0000-0x00000000028F8000-memory.dmp

                Filesize

                32KB

              • memory/4420-41-0x0000000002900000-0x0000000002908000-memory.dmp

                Filesize

                32KB

              • memory/4420-42-0x0000000002910000-0x0000000002918000-memory.dmp

                Filesize

                32KB

              • memory/4420-43-0x000000001B210000-0x000000001B21C000-memory.dmp

                Filesize

                48KB

              • memory/4420-44-0x000000001B220000-0x000000001B22A000-memory.dmp

                Filesize

                40KB

              • memory/4420-38-0x00007FF8D3570000-0x00007FF8D4031000-memory.dmp

                Filesize

                10.8MB

              • memory/4420-46-0x000000001B240000-0x000000001B248000-memory.dmp

                Filesize

                32KB

              • memory/4420-47-0x0000000002920000-0x0000000002928000-memory.dmp

                Filesize

                32KB

              • memory/4420-48-0x000000001B250000-0x000000001B258000-memory.dmp

                Filesize

                32KB

              • memory/4420-39-0x000000001B2D0000-0x000000001B2E0000-memory.dmp

                Filesize

                64KB

              • memory/4420-51-0x000000001B260000-0x000000001B268000-memory.dmp

                Filesize

                32KB

              • memory/4420-52-0x000000001B270000-0x000000001B278000-memory.dmp

                Filesize

                32KB

              • memory/4420-53-0x000000001B290000-0x000000001B298000-memory.dmp

                Filesize

                32KB

              • memory/4420-54-0x000000001B2A0000-0x000000001B2A8000-memory.dmp

                Filesize

                32KB

              • memory/4420-56-0x000000001B380000-0x000000001B388000-memory.dmp

                Filesize

                32KB

              • memory/4420-58-0x000000001B2D0000-0x000000001B2E0000-memory.dmp

                Filesize

                64KB

              • memory/4420-57-0x000000001B390000-0x000000001B398000-memory.dmp

                Filesize

                32KB

              • memory/4420-55-0x000000001B2D0000-0x000000001B2E0000-memory.dmp

                Filesize

                64KB

              • memory/4420-59-0x000000001B3A0000-0x000000001B3A8000-memory.dmp

                Filesize

                32KB

              • memory/4420-60-0x000000001B2D0000-0x000000001B2E0000-memory.dmp

                Filesize

                64KB

              • memory/4420-61-0x000000001B2D0000-0x000000001B2E0000-memory.dmp

                Filesize

                64KB

              • memory/4420-62-0x00007FF8D3570000-0x00007FF8D4031000-memory.dmp

                Filesize

                10.8MB