Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 01:47

General

  • Target

    faf82dcfbb2ffa2a94047a5e017d95e9757aa3420af8cebcef6c8933cde2c295.exe

  • Size

    50.0MB

  • MD5

    0b222b4a899979ddf52b634b82368a08

  • SHA1

    a07b66cde199d96efb99718b9b7d365036350c29

  • SHA256

    faf82dcfbb2ffa2a94047a5e017d95e9757aa3420af8cebcef6c8933cde2c295

  • SHA512

    70c8101223e1e5c5b9aec69d756469ba2ca2370cb92bdc28d4990174f9c2f3d93cc1512049d650fa31f1993ddef49da98007552331a05332741497df5b063e51

  • SSDEEP

    1572864:WK7C5EpF9PX7uC/mVLJhbWnRdrF10hWNYP02oa:WK7CMrLv0JhbWT/mXs2

Malware Config

Signatures

  • DcRat 10 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Detects executables containing bas64 encoded gzip files 4 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\faf82dcfbb2ffa2a94047a5e017d95e9757aa3420af8cebcef6c8933cde2c295.exe
    "C:\Users\Admin\AppData\Local\Temp\faf82dcfbb2ffa2a94047a5e017d95e9757aa3420af8cebcef6c8933cde2c295.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\BoosterX.exe
      "C:\Users\Admin\AppData\Local\Temp\BoosterX.exe"
      2⤵
      • DcRat
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1132
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\system32\zpcS8zO5yqSLxdW.vbe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2920
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\system32\x52n02Ru6CyAUqZaamJgdYl7XD.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1244
          • C:\Users\Admin\AppData\Local\Temp\system32\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\system32\svchost.exe"
            5⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2704
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ldBgWhxY42.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1124
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:1056
                • C:\Users\Default\explorer.exe
                  "C:\Users\Default\explorer.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2312
      • C:\Users\Admin\AppData\Local\Temp\intro.exe
        "C:\Users\Admin\AppData\Local\Temp\intro.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Users\Admin\AppData\Local\Temp\intro.exe
          "C:\Users\Admin\AppData\Local\Temp\intro.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1708
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Default\explorer.exe'" /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2872
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2468
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2300
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\spoolsv.exe'" /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1936
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\spoolsv.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:320
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\spoolsv.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:992
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:588
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1636
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:832

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\BoosterX.exe
      Filesize

      33.2MB

      MD5

      8a5510bea4ccd744c30cc7338a2144c1

      SHA1

      8e96a6e02e5f4da4c5f1bcf60ea402eee4f5be94

      SHA256

      9d0b6ae05c845ce78318d91b514b46947b2e6f37ffb368a1cefee77ad63faee5

      SHA512

      a81d5d63d66b508144888f43c9898aaeda88382d9ede39ae8df74114908a0fcf165d62eafd9454dd23887229d366a012faada248e981926e7d1b4b696454476f

    • C:\Users\Admin\AppData\Local\Temp\Cab43B6.tmp
      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\Tar43B9.tmp
      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Users\Admin\AppData\Local\Temp\Tar4519.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\_MEI27242\python310.dll
      Filesize

      1.4MB

      MD5

      69d4f13fbaeee9b551c2d9a4a94d4458

      SHA1

      69540d8dfc0ee299a7ff6585018c7db0662aa629

      SHA256

      801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

      SHA512

      8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

    • C:\Users\Admin\AppData\Local\Temp\intro.exe
      Filesize

      18.0MB

      MD5

      1d09f385973ff8ee2ad66dff2974e7d1

      SHA1

      6ce3423a6f6c9b1c75b8122b1ac1d6064f20e690

      SHA256

      54acbb15e0440c95c28e55e0ca1fb4133fafb17ad4810eb5608c6108d8b29a5a

      SHA512

      664d85829e1f27a58571db30df1839dd110a957cdb69f2121daad83c6ae2e02f50844b330a458294f89e507e8f1d20c9b83fdb712d7d8414d6eca3845961f703

    • C:\Users\Admin\AppData\Local\Temp\ldBgWhxY42.bat
      Filesize

      194B

      MD5

      0cccdbb8c1756d80402995ce80fd81c9

      SHA1

      322d51e93b6e314bdbc59a3009cd1c05732bc219

      SHA256

      401e557ea1729e130e7fac06f98eed998b15f9da696a0d06060459417c8d2e69

      SHA512

      f24aed060dc815d065fc08653f988d3eded55bee471173575ed346f9cc39f0b7576192c176114eefae88be53dec34d504462f400c7ef76623d5ffea5ef621bda

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      Filesize

      625KB

      MD5

      c42d8a59dfdf8b506966f345e3d1c1d4

      SHA1

      952fc1daa6ab67d9d409e8d8042a660a1d4fc0c4

      SHA256

      116d4d9bb2b20bd34b0361b50fe0d89e092573e298d8c5d711d72c575d0251c5

      SHA512

      c26b0b39ce91765414e78d91d5c1274e96c1d9ec32c30e2bd2ddfc88a89b5ee43919af6307a90687cd3186f18f9fc5823741fc16d3e766e281061d25cd2ec833

    • C:\Users\Admin\AppData\Local\Temp\system32\x52n02Ru6CyAUqZaamJgdYl7XD.bat
      Filesize

      29B

      MD5

      9fbb732e85f6d645a30670510c91a970

      SHA1

      e01aca7db81e73f130fb130a19167e3d15ab1c35

      SHA256

      0cccbc2ae9a033964744611a94a7833113187a44f6ff578cca1f92d5452e4662

      SHA512

      73625ad5f8530bf36da93e03cb95de84e2d8033a2d9586e1fe73fe025198527851e6952cd059ef3c909f8d302ab4434da9d321cf669b0db89d6d5c0a632988e2

    • C:\Users\Admin\AppData\Local\Temp\system32\zpcS8zO5yqSLxdW.vbe
      Filesize

      216B

      MD5

      65444226ae490b86a0fec836b4367a26

      SHA1

      77dce5f1b41473f668e3ff246254829b2ab1fa79

      SHA256

      9976269700d06f1ea5af0002b117026d52e1009846fdb08b5d13bd5bdb571f74

      SHA512

      ec430acce8c93348c34d32daf17df40738617ca64a04a48a82355302fcaeecb6de0c4c8a950cfe11d7b42337b5bda25a0cf75ff76d0e02489c157af0e942b052

    • \Users\Admin\AppData\Local\Temp\system32\svchost.exe
      Filesize

      315KB

      MD5

      424c6a907442c498dc37e7cfab9e62b0

      SHA1

      086872176d32cb129e68f4b3548ac4faa6f6780a

      SHA256

      66ebe251f8bd343f906e26b788c5e3e24a967f876ff7007a24fd40c427752872

      SHA512

      8c8da5892f88841f135e0aa81fd8ede84cdfaa1856bd4f3937d87de79dcf426713d73a34084cdba860b83978a8b0568e9b2c2a0c8da11f112cd8bd0a20164bed

    • memory/1084-2-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp
      Filesize

      9.9MB

    • memory/1084-1-0x0000000000D10000-0x0000000003F16000-memory.dmp
      Filesize

      50.0MB

    • memory/1084-34-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp
      Filesize

      9.9MB

    • memory/1084-0-0x000007FEF5A33000-0x000007FEF5A34000-memory.dmp
      Filesize

      4KB

    • memory/1132-147-0x000000001D4B0000-0x000000001EC86000-memory.dmp
      Filesize

      23.8MB

    • memory/1132-373-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp
      Filesize

      9.9MB

    • memory/1132-10-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp
      Filesize

      9.9MB

    • memory/1132-26-0x0000000001360000-0x0000000003498000-memory.dmp
      Filesize

      33.2MB

    • memory/1708-145-0x000007FEF3DD0000-0x000007FEF423E000-memory.dmp
      Filesize

      4.4MB

    • memory/2312-503-0x00000000011A0000-0x00000000011F6000-memory.dmp
      Filesize

      344KB

    • memory/2704-489-0x0000000000D40000-0x0000000000D96000-memory.dmp
      Filesize

      344KB