Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 01:08

General

  • Target

    29c1eca587a0180b5cdfc0e939ef5b1bb201335d2dea2a1c6427ce37af68325a.exe

  • Size

    2.5MB

  • MD5

    0dfb562500251ae8c085e6e8db7fe3d1

  • SHA1

    00a1c6bb0bd7d99d54e96b714592f4a070b81641

  • SHA256

    29c1eca587a0180b5cdfc0e939ef5b1bb201335d2dea2a1c6427ce37af68325a

  • SHA512

    05578a1553b38cd22570cb5b8bc6e3d4064ab6cf5d05a8537a5a4dd849aac4eda933ccf94d7f765ed03c40b67c6cd89412e15bdbad3a493681cad17387270004

  • SSDEEP

    49152:aozCQ2xc1knReFIs/2M0HVcg+Fk1gMO9:aozCQ31YK+HKvH

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Detects executables packed with SmartAssembly 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\29c1eca587a0180b5cdfc0e939ef5b1bb201335d2dea2a1c6427ce37af68325a.exe
    "C:\Users\Admin\AppData\Local\Temp\29c1eca587a0180b5cdfc0e939ef5b1bb201335d2dea2a1c6427ce37af68325a.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2072
    • C:\Windows\Migration\WTR\taskhost.exe
      "C:\Windows\Migration\WTR\taskhost.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:1740
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\lsm.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2592
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\lsm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1764
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\lsm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2844
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1596
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2476
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2524
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Desktop\taskhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3000
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default\Desktop\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1900
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Desktop\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2456
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:668
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:432
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:576
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dllhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:580
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2576
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2820
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\WTR\taskhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2828
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1648
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Windows\Migration\WTR\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dllhost.exe
    Filesize

    2.5MB

    MD5

    0dfb562500251ae8c085e6e8db7fe3d1

    SHA1

    00a1c6bb0bd7d99d54e96b714592f4a070b81641

    SHA256

    29c1eca587a0180b5cdfc0e939ef5b1bb201335d2dea2a1c6427ce37af68325a

    SHA512

    05578a1553b38cd22570cb5b8bc6e3d4064ab6cf5d05a8537a5a4dd849aac4eda933ccf94d7f765ed03c40b67c6cd89412e15bdbad3a493681cad17387270004

  • memory/1740-34-0x0000000000490000-0x00000000004A2000-memory.dmp
    Filesize

    72KB

  • memory/1740-32-0x0000000000BC0000-0x0000000000E46000-memory.dmp
    Filesize

    2.5MB

  • memory/2072-8-0x0000000000D30000-0x0000000000D86000-memory.dmp
    Filesize

    344KB

  • memory/2072-11-0x0000000000D80000-0x0000000000D92000-memory.dmp
    Filesize

    72KB

  • memory/2072-5-0x0000000000440000-0x0000000000452000-memory.dmp
    Filesize

    72KB

  • memory/2072-6-0x00000000005D0000-0x00000000005D8000-memory.dmp
    Filesize

    32KB

  • memory/2072-7-0x0000000000D20000-0x0000000000D2A000-memory.dmp
    Filesize

    40KB

  • memory/2072-0-0x000007FEF59C3000-0x000007FEF59C4000-memory.dmp
    Filesize

    4KB

  • memory/2072-9-0x0000000000BA0000-0x0000000000BAC000-memory.dmp
    Filesize

    48KB

  • memory/2072-4-0x0000000000B80000-0x0000000000B96000-memory.dmp
    Filesize

    88KB

  • memory/2072-10-0x0000000000D10000-0x0000000000D18000-memory.dmp
    Filesize

    32KB

  • memory/2072-12-0x0000000000B40000-0x0000000000B4C000-memory.dmp
    Filesize

    48KB

  • memory/2072-13-0x0000000000B50000-0x0000000000B5C000-memory.dmp
    Filesize

    48KB

  • memory/2072-3-0x0000000000B60000-0x0000000000B7C000-memory.dmp
    Filesize

    112KB

  • memory/2072-2-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp
    Filesize

    9.9MB

  • memory/2072-33-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp
    Filesize

    9.9MB

  • memory/2072-1-0x00000000012D0000-0x0000000001556000-memory.dmp
    Filesize

    2.5MB