Analysis Overview
SHA256
24cfb58d360a8690723e3b7ebc223f32a550b7694fc21a86b4cd506f6a6bfdf8
Threat Level: Shows suspicious behavior
The file CrystalRELEASE_.rar was found to be: Shows suspicious behavior.
Malicious Activity Summary
Themida packer
Legitimate hosting services abused for malware hosting/C2
Unsigned PE
Command and Scripting Interpreter: JavaScript
Reads runtime system information
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-17 01:56
Signatures
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral15
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
debian9-mipsbe-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral16
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:58
Platform
debian9-mipsel-20240418-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral21
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
ubuntu1804-amd64-20240611-en
Max time kernel
0s
Max time network
70s
Command Line
Signatures
Processes
/tmp/CrystalRELEASE/Editor/.git/hooks/post-update.sample
[/tmp/CrystalRELEASE/Editor/.git/hooks/post-update.sample]
/usr/local/sbin/git
[git update-server-info]
/usr/local/bin/git
[git update-server-info]
/usr/sbin/git
[git update-server-info]
/usr/bin/git
[git update-server-info]
/sbin/git
[git update-server-info]
/bin/git
[git update-server-info]
/snap/bin/git
[git update-server-info]
Network
| Country | Destination | Domain | Proto |
| US | 151.101.193.91:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 89.187.167.6:443 | tcp | |
| GB | 185.125.188.61:443 | tcp | |
| GB | 185.125.188.61:443 | tcp | |
| US | 151.101.193.91:443 | tcp |
Files
Analysis: behavioral22
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
debian9-armhf-20240418-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
win7-20240611-en
Max time kernel
126s
Max time network
154s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalAPI.dll,#1
Network
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
win7-20240508-en
Max time kernel
121s
Max time network
135s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CefSharp.Wpf.dll,#1
Network
Files
Analysis: behavioral17
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
ubuntu1804-amd64-20240611-en
Max time kernel
0s
Max time network
130s
Command Line
Signatures
Processes
/tmp/CrystalRELEASE/Editor/.git/hooks/fsmonitor-watchman.sample
[/tmp/CrystalRELEASE/Editor/.git/hooks/fsmonitor-watchman.sample]
Network
| Country | Destination | Domain | Proto |
| GB | 185.125.188.61:443 | tcp | |
| GB | 185.125.188.61:443 | tcp | |
| US | 151.101.1.91:443 | tcp | |
| US | 151.101.1.91:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 89.187.167.3:443 | tcp |
Files
Analysis: behavioral18
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:01
Platform
debian9-armhf-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral27
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
win7-20240508-en
Max time kernel
118s
Max time network
134s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\Editor\package\dev\vs\basic-languages\abap\abap.js
Network
Files
Analysis: behavioral31
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
win7-20240221-en
Max time kernel
122s
Max time network
135s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\Editor\package\dev\vs\basic-languages\azcli\azcli.js
Network
Files
Analysis: behavioral5
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
win7-20231129-en
Max time kernel
121s
Max time network
136s
Command Line
Signatures
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalUI.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalUI.exe
"C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalUI.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
Files
memory/2168-0-0x000007FEF5A83000-0x000007FEF5A84000-memory.dmp
memory/2168-1-0x000000013FC40000-0x000000013FC60000-memory.dmp
memory/2168-2-0x0000000000740000-0x000000000074A000-memory.dmp
memory/2168-3-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp
memory/2168-4-0x00000000008E0000-0x00000000008EA000-memory.dmp
memory/2168-19-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp
Analysis: behavioral7
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
win7-20240221-en
Max time kernel
121s
Max time network
142s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalUI.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.52\adblock_snippet.js"
Network
Files
Analysis: behavioral12
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
debian9-mipsel-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral13
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
ubuntu1804-amd64-20240508-en
Max time kernel
0s
Max time network
133s
Command Line
Signatures
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
Processes
/tmp/CrystalRELEASE/Editor/.git/hooks/commit-msg.sample
[/tmp/CrystalRELEASE/Editor/.git/hooks/commit-msg.sample]
/usr/bin/uniq
[uniq -c]
/bin/sed
[sed -e /^[ ]*1[ ]/d]
/usr/bin/sort
[sort]
/bin/grep
[grep ^Signed-off-by: ]
Network
| Country | Destination | Domain | Proto |
| GB | 185.125.188.62:443 | tcp | |
| GB | 185.125.188.61:443 | tcp | |
| US | 151.101.193.91:443 | tcp | |
| GB | 89.187.167.7:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
Files
Analysis: behavioral20
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:58
Platform
debian9-mipsel-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral29
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
win7-20240611-en
Max time kernel
120s
Max time network
133s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\Editor\package\dev\vs\basic-languages\apex\apex.js
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:01
Platform
win10v2004-20240226-en
Max time kernel
117s
Max time network
200s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CefSharp.Wpf.dll,#1
Network
| Country | Destination | Domain | Proto |
| GB | 172.217.169.74:443 | tcp | |
| US | 13.107.253.64:443 | tcp | |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.173.189.20.in-addr.arpa | udp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
win10v2004-20240611-en
Max time kernel
114s
Max time network
164s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalAPI.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
Files
Analysis: behavioral10
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:03
Platform
debian9-armhf-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral11
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
debian9-mipsbe-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral14
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:03
Platform
debian9-armhf-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral26
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
win10v2004-20240508-en
Max time kernel
47s
Max time network
59s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\Editor\package\dev\vs\base\worker\workerMain.js
Network
Files
Analysis: behavioral32
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
win10v2004-20240508-en
Max time kernel
137s
Max time network
163s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\Editor\package\dev\vs\basic-languages\azcli\azcli.js
Network
Files
Analysis: behavioral8
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
win10v2004-20240508-en
Max time kernel
46s
Max time network
63s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalUI.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.52\adblock_snippet.js"
Network
Files
Analysis: behavioral19
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:58
Platform
debian9-mipsbe-20240418-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral24
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:58
Platform
debian9-mipsel-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral25
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
win7-20240221-en
Max time kernel
121s
Max time network
132s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\Editor\package\dev\vs\base\worker\workerMain.js
Network
Files
Analysis: behavioral28
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:00
Platform
win10v2004-20240508-en
Max time kernel
46s
Max time network
64s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\Editor\package\dev\vs\basic-languages\abap\abap.js
Network
Files
Analysis: behavioral30
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 02:01
Platform
win10v2004-20240226-en
Max time kernel
108s
Max time network
200s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\Editor\package\dev\vs\basic-languages\apex\apex.js
Network
| Country | Destination | Domain | Proto |
| GB | 96.16.110.114:80 | tcp | |
| US | 13.107.253.64:443 | tcp | |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 159.113.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| NL | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.173.189.20.in-addr.arpa | udp |
Files
Analysis: behavioral23
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
debian9-mipsbe-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
win10v2004-20240508-en
Max time kernel
47s
Max time network
60s
Command Line
Signatures
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalUI.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalUI.exe
"C:\Users\Admin\AppData\Local\Temp\CrystalRELEASE\CrystalUI.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | pastebin.com | udp |
Files
memory/3092-0-0x00007FF9A7A53000-0x00007FF9A7A55000-memory.dmp
memory/3092-1-0x000002273F190000-0x000002273F1B0000-memory.dmp
memory/3092-2-0x000002273F540000-0x000002273F54A000-memory.dmp
memory/3092-3-0x00007FF9A7A50000-0x00007FF9A8511000-memory.dmp
memory/3092-4-0x00007FF9A7A50000-0x00007FF9A8511000-memory.dmp
Analysis: behavioral9
Detonation Overview
Submitted
2024-06-17 01:54
Reported
2024-06-17 01:59
Platform
ubuntu1804-amd64-20240611-en
Max time kernel
0s
Max time network
130s
Command Line
Signatures
Processes
/tmp/CrystalRELEASE/Editor/.git/hooks/applypatch-msg.sample
[/tmp/CrystalRELEASE/Editor/.git/hooks/applypatch-msg.sample]
Network
| Country | Destination | Domain | Proto |
| US | 151.101.1.91:443 | tcp | |
| GB | 185.125.188.62:443 | tcp | |
| GB | 185.125.188.62:443 | tcp | |
| US | 151.101.1.91:443 | tcp | |
| GB | 195.181.164.15:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| GB | 89.187.167.3:443 | 1527653184.rsc.cdn77.org | tcp |