Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 09:53

General

  • Target

    LegacyPhasmo/start.exe

  • Size

    1.1MB

  • MD5

    7002fdc4d02a4ed4a5a6f56bc40efcef

  • SHA1

    cef5ea6d5507392e4fd5cb9511160f4882b4d8b8

  • SHA256

    6fddd93899ba0f1de262aa86d1e7f4ed3df8b29e9d2b9679d42b5a81addea6f4

  • SHA512

    d5859012071a604563d96c8cffb9a5f12ae5a085b0160d3e90de140bd50c752d97287c1810140d72bf2404880fecd8332a458005e5e8052f5ad74cf11f12a538

  • SSDEEP

    24576:U2G/nvxW3Ww0t6eSgFX3x5aC6FRMzpC6nHZW/n:UbA306e9FTtYeP0P

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\LegacyPhasmo\start.exe
    "C:\Users\Admin\AppData\Local\Temp\LegacyPhasmo\start.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\MshyperHostmonitordhcp\0DcM5JqD9S9f9.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\MshyperHostmonitordhcp\MgkA4hhn0q04GXYwCcIaXFzSS.bat" "
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\MshyperHostmonitordhcp\reviewMonitor.exe
          "C:\MshyperHostmonitordhcp\reviewMonitor.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2484
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FC3kSwLXrk.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2932
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:1628
              • C:\MSOCache\All Users\reviewMonitor.exe
                "C:\MSOCache\All Users\reviewMonitor.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1340
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\MshyperHostmonitordhcp\conhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2504
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MshyperHostmonitordhcp\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2012
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\MshyperHostmonitordhcp\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2336
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\winlogon.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2404
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows NT\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2796
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1884
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "reviewMonitorr" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\reviewMonitor.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1300
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "reviewMonitor" /sc ONLOGON /tr "'C:\MSOCache\All Users\reviewMonitor.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1632
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "reviewMonitorr" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\reviewMonitor.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2316
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\de-DE\dwm.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2188
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\de-DE\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:636
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\de-DE\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2696

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MshyperHostmonitordhcp\0DcM5JqD9S9f9.vbe

      Filesize

      224B

      MD5

      d2b97d2aae9482940374f468a574d6a0

      SHA1

      db0b075661a48ce48889d72331bf6f8dc2678156

      SHA256

      7a33058c1663d4917294bc87987b53f98fe9dd03ba8be69f288cafa74ece40bf

      SHA512

      4c17782d77ec02197c012668baaf297df10f8003f512d994343fefff5f9b86be1ecbd6ae8d652a14fb7ae0ccec53d0f5e9ecf40fa0ffa629b190967160502bfa

    • C:\MshyperHostmonitordhcp\MgkA4hhn0q04GXYwCcIaXFzSS.bat

      Filesize

      45B

      MD5

      50ac67118e356521f6739fb631a1bbbe

      SHA1

      68671a07d7a39463726b43c2d53ef535989cccaf

      SHA256

      9373ac51e6c5e168c642e48912b314dd69b2b6a47b401e1741ba992ebc06c4df

      SHA512

      40728b08c37095b39cd4bf67048de5c71f5400433321e37dc4fbc98d77435a960b80734347c25e136b1251324bf7b2b71df7cddb4abc3f213a7113d006996883

    • C:\MshyperHostmonitordhcp\reviewMonitor.exe

      Filesize

      827KB

      MD5

      452f976724291ddcd7fc0d12ff1dc544

      SHA1

      add1cdb2396b67fa42961ee07d91d7a45bad915a

      SHA256

      0285686187df5c5ddfda90a068b02a00eb2ce4fea21ea7adef2e07021707ae7d

      SHA512

      2b637ec0bf44fe2dbd3fe7801413e81cb102eff09fa51c20258fec72c13de8e966ea11db8e0603f54747c18142a0a9a2ccd258cefe25cc32a33931d9da5a6ed3

    • C:\Users\Admin\AppData\Local\Temp\FC3kSwLXrk.bat

      Filesize

      204B

      MD5

      454139e9134c96f3a4bffd7f65a250de

      SHA1

      fa598e5ad180b290a50f370d7af55633fc5397eb

      SHA256

      2c7f256e16447dd3d16daca6ace2f76d88e9b1df45180b8dcff3f2c0525ac4fb

      SHA512

      4aca27848e79dfc8b08e70b68a53d2e3af7b36b8ab1ecd9e4d10d7eae8e4b70be7e2bd8cecb7cf36624c4b2e18526cfd869bcb38f7fc690288697460e4f9c3ab

    • memory/1340-29-0x0000000000EE0000-0x0000000000FB6000-memory.dmp

      Filesize

      856KB

    • memory/2484-13-0x0000000000350000-0x0000000000426000-memory.dmp

      Filesize

      856KB