Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-05-2024 04:02

General

  • Target

    NursultanLoader.exe

  • Size

    1.5MB

  • MD5

    5841e08c36ee75ba2d4002507ceb9be8

  • SHA1

    c679478e7041b2c3f0659403e87dc1bf011e7f2c

  • SHA256

    85905bb938abe1ea461869f73103f364f2dddaae579f35d460338a21db8b8056

  • SHA512

    2fdd014e5c128e7bb6112cc3facf50dd413dbb7d9e705d7c3b21dd0a9d4717281d1bdb62bf416ed1e651bea8177db3d3ae0b3ac6ba729e0eb9010e694d8d7744

  • SSDEEP

    24576:U2G/nvxW3Ww0tQ++c2ARnuEWKoBc07UfctVGE9KnBvENv2ONSStxU:UbA30PiLKoJ5tsHnBMQgSStu

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\SavesDllcommon\gdNhr8l.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3148
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\SavesDllcommon\BRvogp3keJwY6M0FyR4uWbtTK.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\SavesDllcommon\fontsaves.exe
          "C:\SavesDllcommon\fontsaves.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4464
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0s5aAbSAde.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:724
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:3508
              • C:\SavesDllcommon\conhost.exe
                "C:\SavesDllcommon\conhost.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3224
                • C:\Users\Admin\AppData\Local\Temp\Delete System32.exe
                  "C:\Users\Admin\AppData\Local\Temp\Delete System32.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  PID:2644
                • C:\Users\Admin\AppData\Local\Temp\Meatspin_FULL.exe
                  "C:\Users\Admin\AppData\Local\Temp\Meatspin_FULL.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:2624
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\cmd.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4860
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\cmd.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3576
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\cmd.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4128
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\SavesDllcommon\services.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:844
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\SavesDllcommon\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1104
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\SavesDllcommon\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2028
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\SavesDllcommon\conhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1696
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\SavesDllcommon\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4932
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\SavesDllcommon\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2708
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3160

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\SavesDllcommon\BRvogp3keJwY6M0FyR4uWbtTK.bat
      Filesize

      33B

      MD5

      0a9ef172b5e9daeb9c3366842676eac9

      SHA1

      18ce47e6f7a7dc2a4c0882a7fa1e69bc91f22cd2

      SHA256

      4193c6cb4fcc0e633a062825fc4b510d826d68063be74cf7f37d5db3a75ea2b6

      SHA512

      dc1985d420f4d7058529acd1afce2bd9e047f95074a3f12ca0923903bb3dab615fb938464d6a75adfd4a890aa3eeda9797c13bfb867bb02e02945af3c108d563

    • C:\SavesDllcommon\fontsaves.exe
      Filesize

      1.2MB

      MD5

      73ace1b8b0f1b1c088f11ee29b13ae6b

      SHA1

      4b7fa04aacb5a23ab37b9caaee8f852a1bd33bbc

      SHA256

      8be76a2960a823f9284836868172eff28b64de44daba8b09f91ff678bb22d614

      SHA512

      1e13cc8ac20c9e10cd13f78cb54e75b23ad255d1601d45ee78770f3cb74fe5e9bb3e84d8ca8f7c44659365da45a79b72be85d6433a8bbbac79b925839cc7e4d1

    • C:\SavesDllcommon\gdNhr8l.vbe
      Filesize

      216B

      MD5

      67750c3e2cc7970484d8e1f3e95c4454

      SHA1

      b4a6e933dfda3db9a2663798f421a2b06a0c5b35

      SHA256

      a5c935975dff3bdbd1fd9c63abc8c47d2e24dd408dd5d0760b8af2db291c9655

      SHA512

      d794c9fdc99334fe3627d03e63e41d67a6f47e5b1601eb3c4c9cd037dd6b74c238e3bd8510c7755fd4e6f366b140bf9b82d6fbe734237ee8d44de51a193c1fa9

    • C:\Users\Admin\AppData\Local\Temp\0s5aAbSAde.bat
      Filesize

      194B

      MD5

      b3033fea848da45648728ca002c3589c

      SHA1

      dc32ffa87b9600a386fd8df265458b7bc94090f7

      SHA256

      1dce24f4212eea77aec6fcea662f27bb6a36b4f57dd4de6723ba32652a1b7f84

      SHA512

      010588168c9ac2988388bc28ba7da91015291ce6bb1d83b3b925f682b7966fc93eb7d2da7dcb39652ca2c19023cf5ab47856d0917950caeac403e3bc9be76676

    • C:\Users\Admin\AppData\Local\Temp\Delete System32.exe
      Filesize

      500KB

      MD5

      07a9f858f9867f52163d7cec3bd899e3

      SHA1

      d7feae9f88b807606b747a27ac95ede57b2615f5

      SHA256

      0fde5da043382f46f04eaa04028fba0d127c20b87b88fbd7966805d5c93307ca

      SHA512

      e07185b51ea52aa9850beaa099a621383a06d452666e96b25e2f0a9f7152fe5f4dbcc8a75a6cb336ee80c4273f85d04abdc142e7d0f87a4f2a9b85a51036cb30

    • C:\Users\Admin\AppData\Local\Temp\Meatspin_FULL.exe
      Filesize

      3.8MB

      MD5

      137c1b0243beb35b6a0b6dbe632dc341

      SHA1

      b710da533d9a33f4d7fc78d317bbcee8dc95826d

      SHA256

      86cd8a8dc5228014e559788e7a0f5ed6fef637691bf53111e9eab4187a0652ab

      SHA512

      49ee75b71223ed47ae81a089247ff3002d50f70ede8e57af42f73745bbf7cb8ee7c71c1ab5da9d967fbe0b2f9de5dad70f4a7f4cfe44ba104d5a60be53eccabf

    • memory/2624-109-0x00000109406F0000-0x0000010940736000-memory.dmp
      Filesize

      280KB

    • memory/2624-110-0x000001093FC90000-0x000001093FC99000-memory.dmp
      Filesize

      36KB

    • memory/2624-111-0x000001093FCC0000-0x000001093FCCD000-memory.dmp
      Filesize

      52KB

    • memory/2624-112-0x000001093FDE0000-0x000001093FDFE000-memory.dmp
      Filesize

      120KB

    • memory/2624-113-0x000001093FE00000-0x000001093FE0B000-memory.dmp
      Filesize

      44KB

    • memory/2624-103-0x00000109253A0000-0x0000010925764000-memory.dmp
      Filesize

      3.8MB

    • memory/3224-35-0x000000001B990000-0x000000001B99D000-memory.dmp
      Filesize

      52KB

    • memory/3224-37-0x000000001B9A0000-0x000000001B9AB000-memory.dmp
      Filesize

      44KB

    • memory/3224-36-0x000000001C3A0000-0x000000001C3BE000-memory.dmp
      Filesize

      120KB

    • memory/3224-34-0x000000001B450000-0x000000001B459000-memory.dmp
      Filesize

      36KB

    • memory/3224-33-0x000000001C350000-0x000000001C396000-memory.dmp
      Filesize

      280KB

    • memory/4464-16-0x000000001BD80000-0x000000001BD96000-memory.dmp
      Filesize

      88KB

    • memory/4464-17-0x000000001BC40000-0x000000001BC4C000-memory.dmp
      Filesize

      48KB

    • memory/4464-15-0x000000001BDD0000-0x000000001BE20000-memory.dmp
      Filesize

      320KB

    • memory/4464-14-0x000000001BD60000-0x000000001BD7C000-memory.dmp
      Filesize

      112KB

    • memory/4464-13-0x0000000000EA0000-0x0000000000FD2000-memory.dmp
      Filesize

      1.2MB

    • memory/4464-12-0x00007FFDEFC33000-0x00007FFDEFC35000-memory.dmp
      Filesize

      8KB