Analysis

  • max time kernel
    136s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 08:56

General

  • Target

    1b8dc013de93bb0edf121b38e7f8ab6f.exe

  • Size

    828KB

  • MD5

    1b8dc013de93bb0edf121b38e7f8ab6f

  • SHA1

    2c17ada00c2b779f5e04a801265f151591e11e18

  • SHA256

    00126f1a772fd459793f811457950e42177537f6387a76124d26b57266a79f1c

  • SHA512

    4b23622774ea394608ade50bac520aebd64788d626e9fc316e57db8f4a4628cec221420955adae70d7ddcd7c273f6cac409d64f931e01e1a490b275788370d33

  • SSDEEP

    12288:K8rQgxfLc/EHk/2Wk3D0bdxTZiLaO4Vb/5:VrzxfLFkHbXdVLVb/5

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 51 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b8dc013de93bb0edf121b38e7f8ab6f.exe
    "C:\Users\Admin\AppData\Local\Temp\1b8dc013de93bb0edf121b38e7f8ab6f.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\G7KEsLrQzU.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1824
        • C:\Program Files (x86)\Windows Defender\backgroundTaskHost.exe
          "C:\Program Files (x86)\Windows Defender\backgroundTaskHost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1420
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:1724
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:5012
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:1944
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\Media\dwm.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:2880
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Media\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:1448
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\Media\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:3356
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Favorites\backgroundTaskHost.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:4020
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default\Favorites\backgroundTaskHost.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:3728
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Favorites\backgroundTaskHost.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:4272
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:1728
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:1312
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:2436
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:1128
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:4368
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:1528
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:2692
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:3264
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:4920
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\MusNotification.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:5056
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Users\Default User\MusNotification.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:1612
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\MusNotification.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:2672
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "1b8dc013de93bb0edf121b38e7f8ab6f1" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\1b8dc013de93bb0edf121b38e7f8ab6f.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:3156
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "1b8dc013de93bb0edf121b38e7f8ab6f" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\1b8dc013de93bb0edf121b38e7f8ab6f.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:4576
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "1b8dc013de93bb0edf121b38e7f8ab6f1" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\1b8dc013de93bb0edf121b38e7f8ab6f.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:5072
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\it-IT\RuntimeBroker.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:3952
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:3676
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:3232
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\CbsTemp\csrss.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:3932
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\CbsTemp\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:4824
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\CbsTemp\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:4408
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\Idle.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:4004
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:3540
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:4628
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dwm.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:4924
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:440
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:1864
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\taskhostw.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:536
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\taskhostw.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:3588
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\taskhostw.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:1568
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\WindowsHolographicDevices\Idle.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:1208
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:5116
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\WindowsHolographicDevices\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:4048
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\backgroundTaskHost.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:2884
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\backgroundTaskHost.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:2396
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\backgroundTaskHost.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:640
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\unsecapp.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:5088
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\TAPI\unsecapp.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:3648
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\unsecapp.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:748
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\SoftwareDistribution\DataStore\sppsvc.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:2736
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\DataStore\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:1072
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\SoftwareDistribution\DataStore\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:5024

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\WindowsRE\fontdrvhost.exe

      Filesize

      828KB

      MD5

      1b8dc013de93bb0edf121b38e7f8ab6f

      SHA1

      2c17ada00c2b779f5e04a801265f151591e11e18

      SHA256

      00126f1a772fd459793f811457950e42177537f6387a76124d26b57266a79f1c

      SHA512

      4b23622774ea394608ade50bac520aebd64788d626e9fc316e57db8f4a4628cec221420955adae70d7ddcd7c273f6cac409d64f931e01e1a490b275788370d33

    • C:\Users\Admin\AppData\Local\Temp\G7KEsLrQzU.bat

      Filesize

      227B

      MD5

      6c7391d0742c725876fed8ce72ffc3a5

      SHA1

      92081f10425bc41bd3d1936792fc347150a89263

      SHA256

      b10a4f6e7cf520d57872d7ee7a71b04060dd2961d36eae57ed3af13163ecf1d4

      SHA512

      041ce25604e311c1e7cd3dfad7d3856ad9881ce1c22fca1289e78c94815f081dd26ee417cdb61fe6a1fdac24d35573586c590c7c917cb3734ee0699296a76ebf

    • memory/4524-1-0x00007FFB72AD3000-0x00007FFB72AD5000-memory.dmp

      Filesize

      8KB

    • memory/4524-0-0x0000000000610000-0x00000000006E6000-memory.dmp

      Filesize

      856KB

    • memory/4524-2-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

      Filesize

      10.8MB

    • memory/4524-43-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

      Filesize

      10.8MB