Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 21:26

General

  • Target

    3d71f1e177234c396f2a5d7d852a2376.exe

  • Size

    1.4MB

  • MD5

    3d71f1e177234c396f2a5d7d852a2376

  • SHA1

    fe960120b965c91a3021fbea60e1b2c77ec78b63

  • SHA256

    c0db54d6ec9c0e2310d4c8bfd1739f079a0fd85adcf088ff8876f54485a61f2c

  • SHA512

    e2bc7e6027b32088580ab4e2a074d23c8be77ef5992f502fadb0875316a2b2f79bd9d1668568d99867715d5e60ee2fa236c903ba668cfd868142e3d18bbda82c

  • SSDEEP

    24576:U2G/nvxW3Ww0tHzmBv0vDGt3r6+yWJmgHgwSRADpDial:UbA30HzFGnJ2wS+1ic

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d71f1e177234c396f2a5d7d852a2376.exe
    "C:\Users\Admin\AppData\Local\Temp\3d71f1e177234c396f2a5d7d852a2376.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\DCRAT\u3Ah4o8.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\DCRAT\VmabnRVk3Q0Z4Rsmx4y.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Users\Admin\AppData\Roaming\DCRAT\RAT.exe
          "C:\Users\Admin\AppData\Roaming\\DCRAT\RAT.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\DCRAT\RAT.exe

    Filesize

    1.1MB

    MD5

    4cf21cf4fe938861269eee0dce7ab40a

    SHA1

    8edccf6b4ce1a73419d25632d9707d1e473bfedc

    SHA256

    267c6d4e9f47e320bc83d14ae62a3b3942b5bc52271981a62634be7859d3e41a

    SHA512

    c5cdf840d65ab2e78480c1a172250696860a70953dade41463352d47f89183c40c15d0672c9268fea68711eb432ff5167189de0bac90fc83b81d563a808f2879

  • C:\Users\Admin\AppData\Roaming\DCRAT\VmabnRVk3Q0Z4Rsmx4y.bat

    Filesize

    26B

    MD5

    6938225aa9b06be749c03e2ed1d0a8a1

    SHA1

    9c18762161a7b0fb2ba460d649fa3797d6b048e3

    SHA256

    298f4bc92dc502984c2b53207f096788fd77e095ca3f66a512a49ff2d8fd6b59

    SHA512

    1be9139357b9ffe68a36bf4ba59141b9940ff5f54caa331bdcfe046f52a1f973542b54d2c383e9dea8ea01b4f3154d74d5c7a2af71910d9414ef79ff20d41327

  • C:\Users\Admin\AppData\Roaming\DCRAT\u3Ah4o8.vbe

    Filesize

    206B

    MD5

    d25609d0ea00bd9b4034f6c115d73176

    SHA1

    9b4e9ce99da10017399de6ef8d9ac055f1f6fb5f

    SHA256

    1be67ff6caccef7bc37346582d6ee3ffec585ce4a139c23a4d8fa1a2cad0836e

    SHA512

    c976d90d4b8f2d8aa7f8810e858acc13d51b2eb366fc1780145d24ded22fcb32c08bdb275db29d414cb217e4591fa821a42984149b1072660d28af2932348221

  • memory/4428-12-0x00007FFBA3163000-0x00007FFBA3165000-memory.dmp

    Filesize

    8KB

  • memory/4428-13-0x0000000000800000-0x0000000000924000-memory.dmp

    Filesize

    1.1MB

  • memory/4428-14-0x0000000001380000-0x000000000139C000-memory.dmp

    Filesize

    112KB

  • memory/4428-16-0x000000001B500000-0x000000001B516000-memory.dmp

    Filesize

    88KB

  • memory/4428-15-0x000000001BC20000-0x000000001BC70000-memory.dmp

    Filesize

    320KB

  • memory/4428-17-0x00007FFBA3163000-0x00007FFBA3165000-memory.dmp

    Filesize

    8KB