Analysis

  • max time kernel
    51s
  • max time network
    68s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-06-2024 19:58

General

  • Target

    Loader.exe

  • Size

    1.8MB

  • MD5

    289f27e7a02f8e76ebf39d2c0c3f09e4

  • SHA1

    fb404a7a85d5fb617436f73832e4716556756d6a

  • SHA256

    854d267aea33e8dc80021ac043b003ab7c6f99061e56e36572cba3548e6882c9

  • SHA512

    38798cc71da6dfd8022dff2be635db8b938ba8d8dc5db8196802af2d9deb26dda145e0e581a6b8eb7022a1e0c33ff34c666cc4817f9f2ac50d1f362f434a75fe

  • SSDEEP

    24576:KuDXTIGaPhEYzUzA0Dz46fMR/6Y/M3pPux8KVzVvu9JDcEL0NLpgjdyWhPOePTnK:9Djlabwz9PHMf/M3BuxbzuDQyBPXam0H

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3192
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Loader\AntiCheatBypass.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\system32\cacls.exe
        "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
        3⤵
          PID:2056
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\Loader\AntiCheatBypasss.bat
          3⤵
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1936
          • C:\Windows\system32\choice.exe
            choice /c y /n /t 10 /d y
            4⤵
              PID:2508
            • C:\Windows\system32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\WINDOWS\system32\userinit.exe, C:\Users\skeet\AppData\Local\Temp\Loader\572stuOQ0pZG2Xj.exe" /f
              4⤵
              • Modifies WinLogon for persistence
              PID:4972
            • C:\Windows\system32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\WINDOWS\system32\explorer.exe, C:\ProgramData\SoftwareDistribution\572stuOQ0pZG2Xj.exe" /f
              4⤵
              • Modifies WinLogon for persistence
              PID:4508
            • C:\Users\Admin\AppData\Local\Temp\Loader\572stuOQ0pZG2Xj.exe
              C:\Users\Admin\AppData\Local\Temp\Loader\572stuOQ0pZG2Xj.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1396
              • C:\ProgramData\SoftwareDistribution\Bypass.exe
                "C:\ProgramData\SoftwareDistribution\Bypass.exe"
                5⤵
                • Executes dropped EXE
                • Drops autorun.inf file
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2656
            • C:\Users\Admin\AppData\Local\Temp\Loader\Loader.exe
              C:\Users\Admin\AppData\Local\Temp\Loader\Loader.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2068
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                  PID:2132
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                    PID:3436
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    5⤵
                      PID:2772
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Loader\vO7REz65fRBWcJa.vbs"
                    4⤵
                      PID:2136
              • C:\Windows\system32\BackgroundTransferHost.exe
                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                1⤵
                  PID:3884
                • C:\Windows\system32\LogonUI.exe
                  "LogonUI.exe" /flags:0x4 /state0:0xa3a2b855 /state1:0x41c64e6d
                  1⤵
                    PID:4692

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\SoftwareDistribution\Bypass.exe
                    Filesize

                    1.8MB

                    MD5

                    93e99fb34ac2cd9d6e867e24dcafb2ab

                    SHA1

                    c6ee148abc972494c2912e68534512160372f4a6

                    SHA256

                    8cf7a779191a6b146749de10a52303201d4c72621f04d1336d51f400256d662e

                    SHA512

                    65ade8226509bdf7b160f04bc6cbb12c790c7a960ddee6776aa0e6094246062f323a80dd2d858a49aafef5cc5db2ade00a8a42d939ff3571029172aa7d34d877

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    Filesize

                    2KB

                    MD5

                    627073ee3ca9676911bee35548eff2b8

                    SHA1

                    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                    SHA256

                    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                    SHA512

                    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    d0a4a3b9a52b8fe3b019f6cd0ef3dad6

                    SHA1

                    fed70ce7834c3b97edbd078eccda1e5effa527cd

                    SHA256

                    21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

                    SHA512

                    1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

                  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\b651c4cd-cd72-474c-abf3-9ef5fd5d724d.down_data
                    Filesize

                    555KB

                    MD5

                    5683c0028832cae4ef93ca39c8ac5029

                    SHA1

                    248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                    SHA256

                    855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                    SHA512

                    aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                  • C:\Users\Admin\AppData\Local\Temp\Loader\572stuOQ0pZG2Xj.exe
                    Filesize

                    1.2MB

                    MD5

                    43af303e1f32ce8c477abbfb07887ea2

                    SHA1

                    c69b0f73b6219d05cec8258c445af5f39d3313c9

                    SHA256

                    37493d6b5fd0f186bb2e70edfafe91f28b43938293965461a7eefb5cca4c36bf

                    SHA512

                    68d0ed901c7aa8bc6de3f8d83fea9c0a362d6582ea54b052941f9a02c25b9bb32b096bd8efe73506985ad7b94eea0757a35cb3924e845d8f69216ce999327774

                  • C:\Users\Admin\AppData\Local\Temp\Loader\AntiCheatBypass.bat
                    Filesize

                    9KB

                    MD5

                    4c44aab923a5c7719850e5138ecb64c0

                    SHA1

                    9634bb1db8ed400b033225a849c88c7908d61b3d

                    SHA256

                    63047a792bde6efb6aab1a6dbb178f55b6ae86317d75cb4470e51dd0ef76be2e

                    SHA512

                    98fd476c2b48be92a6101ff71514818eca6c7849ad17097b86babbbae9ecc9ff60a0a88c143a6ccbb67f002798531ab3717ad3fd7246de53c49b8daaeebad8f0

                  • C:\Users\Admin\AppData\Local\Temp\Loader\AntiCheatBypasss.bat
                    Filesize

                    8KB

                    MD5

                    67789813c0d52fa2d7bfbffd5d572e6e

                    SHA1

                    52389d023f55bda8aba2efdbe82ee48c17f19639

                    SHA256

                    ab044df54893f5f2e54233fc6ea4ef6dd8a9a0731a893734f287e62eeae0c3cf

                    SHA512

                    467f875a6bf70a39fcb4918952706d41f92c0166c4c2ad2a9c6b2207c7ac076a155dbc9b7682e65f9f9498c3636bd2b04e2aad5b2b89a185ea22bb6146980527

                  • C:\Users\Admin\AppData\Local\Temp\Loader\Loader.exe
                    Filesize

                    594KB

                    MD5

                    b6c3c00d7cf6d8d13f20dbc590a675ad

                    SHA1

                    a36e5c3c94f7abe3cbdfd3418e3ae03e66aa5323

                    SHA256

                    0021b20ecb3a2d562118bae38f00d1bdffc8facda49c8e1d1995966e1cd7957c

                    SHA512

                    e6f5165b9678cc6818d0213e84a6fdfb606af69dd6be67ea3db12dbb4a8b3503afcb9dc729a727691bef2374a355ea3ab7d8f8864adcab87d0cfee892c660eba

                  • C:\Users\Admin\AppData\Local\Temp\Loader\vO7REz65fRBWcJa.vbs
                    Filesize

                    1KB

                    MD5

                    f6c38031293030ef28e5806abb9d072d

                    SHA1

                    1c5c39f986c9e717d85321536e44541aa3a6f33b

                    SHA256

                    76166b3a990a0f6606fa9ad1ed52daa04ce37f813865c539e5d1f68da9ebeba1

                    SHA512

                    8bfbac376e92ce870310926bdf42fbcce4ec10829e508c6e2b546d25da77b78ad8f2b7718c5cc1409962da7214d83f379b3ee6cba6b9849a3a525aa4029035b2

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zhjiu5uw.apk.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • memory/1936-19-0x000001C9266C0000-0x000001C9266E2000-memory.dmp
                    Filesize

                    136KB

                  • memory/2656-50-0x000000001AF90000-0x000000001AFA0000-memory.dmp
                    Filesize

                    64KB

                  • memory/2656-93-0x000000001B940000-0x000000001B949000-memory.dmp
                    Filesize

                    36KB

                  • memory/2656-51-0x000000001AFA0000-0x000000001AFB6000-memory.dmp
                    Filesize

                    88KB

                  • memory/2656-52-0x000000001B6A0000-0x000000001B6F6000-memory.dmp
                    Filesize

                    344KB

                  • memory/2656-49-0x000000001AFE0000-0x000000001B030000-memory.dmp
                    Filesize

                    320KB

                  • memory/2656-53-0x000000001AFC0000-0x000000001AFCE000-memory.dmp
                    Filesize

                    56KB

                  • memory/2656-94-0x000000001C500000-0x000000001C50D000-memory.dmp
                    Filesize

                    52KB

                  • memory/2656-48-0x0000000002690000-0x00000000026AC000-memory.dmp
                    Filesize

                    112KB

                  • memory/2656-96-0x000000001C530000-0x000000001C53B000-memory.dmp
                    Filesize

                    44KB

                  • memory/2656-95-0x000000001C510000-0x000000001C52E000-memory.dmp
                    Filesize

                    120KB

                  • memory/2656-92-0x000000001C2B0000-0x000000001C2F6000-memory.dmp
                    Filesize

                    280KB

                  • memory/2656-47-0x0000000000240000-0x000000000040A000-memory.dmp
                    Filesize

                    1.8MB

                  • memory/2772-46-0x0000000000400000-0x0000000000455000-memory.dmp
                    Filesize

                    340KB

                  • memory/2772-45-0x0000000000400000-0x0000000000455000-memory.dmp
                    Filesize

                    340KB