Analysis
-
max time kernel
40s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 00:16
Behavioral task
behavioral1
Sample
1b6293c7f0dfed044b0eba8b98b0faff.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1b6293c7f0dfed044b0eba8b98b0faff.exe
Resource
win10v2004-20240508-en
General
-
Target
1b6293c7f0dfed044b0eba8b98b0faff.exe
-
Size
1.4MB
-
MD5
1b6293c7f0dfed044b0eba8b98b0faff
-
SHA1
e5705cbb256bb0b1a350e1b9fb71c1a1e4ac605a
-
SHA256
fe014092ae92e8372849bed9f5cf33946e8d918bdc50feddc1316bc837414ba8
-
SHA512
694e9afd04089172c991a712849049545459ceeed99780a6f012ca086fa2d1b70bbd627534b85b1797f4be22feda55e46e6966fe96a2ee66effdeeaa2eb650a5
-
SSDEEP
24576:d2G/nvxW3WckpJWjXbNQsVZy8v8BQSsZWcJ48z2AB4:dbA3wvW+sVZy8fZWmz9
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1253689379948593173/lzPh5dDD7ETWYLRPMt2M_Ml82yS42YxolYTwBWldi4NXuLOvpMPhz7AlFtFln1RxcqaC
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4872 1812 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1576 1812 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3536 1812 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4932 1812 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3764 1812 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4532 1812 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3828 1812 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1488 1812 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1432 1812 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/3100-1-0x0000000000F70000-0x00000000010DC000-memory.dmp dcrat C:\Users\Admin\AppData\Local\Temp\svchost.exe dcrat C:\Hypercommon\ServercrtDll.exe dcrat behavioral2/memory/1284-39-0x0000000000C30000-0x0000000000D06000-memory.dmp dcrat -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1b6293c7f0dfed044b0eba8b98b0faff.exesvchost.exeWScript.exeServercrtDll.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 1b6293c7f0dfed044b0eba8b98b0faff.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation ServercrtDll.exe -
Executes dropped EXE 4 IoCs
Processes:
svchost.exeexplorer.exeServercrtDll.exefontdrvhost.exepid process 2756 svchost.exe 4596 explorer.exe 1284 ServercrtDll.exe 2572 fontdrvhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
svchost.exeServercrtDll.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings ServercrtDll.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1576 schtasks.exe 3536 schtasks.exe 4932 schtasks.exe 3764 schtasks.exe 4532 schtasks.exe 1488 schtasks.exe 1432 schtasks.exe 4872 schtasks.exe 3828 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
explorer.exeServercrtDll.exefontdrvhost.exepid process 4596 explorer.exe 4596 explorer.exe 1284 ServercrtDll.exe 1284 ServercrtDll.exe 1284 ServercrtDll.exe 1284 ServercrtDll.exe 2572 fontdrvhost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
explorer.exeServercrtDll.exefontdrvhost.exedescription pid process Token: SeDebugPrivilege 4596 explorer.exe Token: SeDebugPrivilege 1284 ServercrtDll.exe Token: SeDebugPrivilege 2572 fontdrvhost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
1b6293c7f0dfed044b0eba8b98b0faff.exesvchost.exeWScript.execmd.exeServercrtDll.execmd.exedescription pid process target process PID 3100 wrote to memory of 2756 3100 1b6293c7f0dfed044b0eba8b98b0faff.exe svchost.exe PID 3100 wrote to memory of 2756 3100 1b6293c7f0dfed044b0eba8b98b0faff.exe svchost.exe PID 3100 wrote to memory of 2756 3100 1b6293c7f0dfed044b0eba8b98b0faff.exe svchost.exe PID 3100 wrote to memory of 4596 3100 1b6293c7f0dfed044b0eba8b98b0faff.exe explorer.exe PID 3100 wrote to memory of 4596 3100 1b6293c7f0dfed044b0eba8b98b0faff.exe explorer.exe PID 2756 wrote to memory of 4844 2756 svchost.exe WScript.exe PID 2756 wrote to memory of 4844 2756 svchost.exe WScript.exe PID 2756 wrote to memory of 4844 2756 svchost.exe WScript.exe PID 4844 wrote to memory of 3928 4844 WScript.exe cmd.exe PID 4844 wrote to memory of 3928 4844 WScript.exe cmd.exe PID 4844 wrote to memory of 3928 4844 WScript.exe cmd.exe PID 3928 wrote to memory of 1284 3928 cmd.exe ServercrtDll.exe PID 3928 wrote to memory of 1284 3928 cmd.exe ServercrtDll.exe PID 1284 wrote to memory of 736 1284 ServercrtDll.exe cmd.exe PID 1284 wrote to memory of 736 1284 ServercrtDll.exe cmd.exe PID 736 wrote to memory of 4604 736 cmd.exe w32tm.exe PID 736 wrote to memory of 4604 736 cmd.exe w32tm.exe PID 736 wrote to memory of 2572 736 cmd.exe fontdrvhost.exe PID 736 wrote to memory of 2572 736 cmd.exe fontdrvhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b6293c7f0dfed044b0eba8b98b0faff.exe"C:\Users\Admin\AppData\Local\Temp\1b6293c7f0dfed044b0eba8b98b0faff.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Hypercommon\s6qV8wojz3Yx3vhyfOAzGuFvxlJ5l.vbe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Hypercommon\Udwe1ynNPaETo.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Hypercommon\ServercrtDll.exe"C:\Hypercommon\ServercrtDll.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BgsClO9IFy.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:4604
-
-
C:\Users\Public\Music\fontdrvhost.exe"C:\Users\Public\Music\fontdrvhost.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Music\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Music\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
MD5801d5740c780d09b1cc6d971ce8b280f
SHA1c7188e6f5998405d9dcbe83ce5d29267861be07d
SHA256b678bee38602b80df34f15e4555bb689e2eb6aef26f4c273d652c88f8825c33f
SHA5123296e517a6e0d6d3feb1f9d1544664b87589130d8a28f205626b2182ecdf333ff404f311ce69730d509e3072432024d3ed16db7068d35925375d9ecc5fe82b49
-
Filesize
33B
MD51af82b77403306ff43f68bf7a0786c52
SHA1730a3bd4b524ffa024657c1fc27ffd82e25f3f81
SHA256e358e4c2fc541cc4e5614b1af9360a85a32fc53babbc57ecf5858fe71d334f96
SHA5120e33b779aceb2a42f5c42e07bcd3ac70a3dbb1fd2bbd4ae154979735f58eeaab5abea05cea682f4b73f6b54174ace8ac3046c6e9a84c4a729a6ed2bffa1a9ec1
-
Filesize
201B
MD50f314eb5d52ce9cd85095eadff4f908c
SHA1272d25d43f789dd5fad479ab31e96214f82302b3
SHA256f17ea2d9d889ef2012cb57191ad3a1d2d3351df8539b4029d6f7080d66217e89
SHA512471b72558c045bc4acd276087d82e564aa7685373dea3ac3e90390df0f7f42ea06ae0254d3a4a9dc57312c7b1485916f4d470bd353b4b8c0b35d705573105f09
-
Filesize
202B
MD5096410ff9636c2c9cdaa1765b3c96ece
SHA10950e3c6def2875d9480ba6b6c6bdf3ebeb70152
SHA25639bc6f177ccade9b73a38dd2a813c2213537d2f78a080a08fd776a5828aa924e
SHA51205ec4437164c603fae98069d522edec7520a5af844ea5c071ad37211273c8ca2ade2f7d37c74ef3a941348ce41fb8bdb0074d9f95ce34ff4b38c4935073ef2c0
-
Filesize
303KB
MD57d9282b8529bbb4ac06a3994fbcd0622
SHA1d38d467c5e533f3bc247b6ed245fb08412a479d7
SHA256ca5820bbbcbefd08f5ec820b833b23f7f97556a247da39510a70cbe7b809e3a9
SHA512aec2d63548176dc1a8ad3d2dfce0bc41973230c6898c55171dec7fc2919b84a8061d4308449c9551cc40ac7c08ad773fd6a7818bbd748ede9be64acc11dcfca5
-
Filesize
1.1MB
MD53ee661f4a9794c72a91fa1f783f54969
SHA135780f52351da65b60cc63b302018950cbfe849f
SHA256ebcaf07121ce2483989e7a71d00b83c54b942f71e51271d5b28886ef03e45b51
SHA5120b53edac853f257b3c40b8b8014f0b0d53f546410d352965eace8eb251b2d75aa02e171586750a70dd97a4bc103b4b7707e90d5bd7a47c786858514f83281bde