Analysis
- max time kernel
0s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
01/07/2024, 02:51
General
- Target 902f94aa7222739a873f8f2805428e89822fc34842a0d731828ca0d6fce69dd6.exe
- Size 2.3MB
- Sample240701-dce54axdpk
- SHA256 902f94aa7222739a873f8f2805428e89822fc34842a0d731828ca0d6fce69dd6
Malware Config
Extracted
-
xworm
-
football-emily.gl.at.ply.gg:39625
-
Install_directory
%AppData%
-
install_file
Registry.exe
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect Xworm Payload 4 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- DCRat payload 4 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Themida packer 20 IoCs
Detects Themida, an advanced Windows software protection system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\902f94aa7222739a873f8f2805428e89822fc34842a0d731828ca0d6fce69dd6.exe"C:\Users\Admin\AppData\Local\Temp\902f94aa7222739a873f8f2805428e89822fc34842a0d731828ca0d6fce69dd6.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Bootstrapper.exe"C:\Users\Admin\AppData\Roaming\Bootstrapper.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Bootstrapper.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Bootstrapper.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Registry.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Registry.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Registry" /tr "C:\Users\Admin\AppData\Roaming\Registry.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"3⤵
-
-
-
C:\ProgramData\Bootstrapper.exe"C:\ProgramData\Bootstrapper.exe"2⤵
-
C:\ProgramData\SolaraBootstrapper.exe"C:\ProgramData\SolaraBootstrapper.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Boostraper.bat"C:\Users\Admin\AppData\Local\Temp\Boostraper.bat"2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Media\3KNj5pJ.bat" "4⤵
-
C:\Media\fontreview.exe"C:\Media\fontreview.exe"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Registry.exeC:\Users\Admin\AppData\Roaming\Registry.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Registry.exeC:\Users\Admin\AppData\Roaming\Registry.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Registry.exeC:\Users\Admin\AppData\Roaming\Registry.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3KNj5pJ.bat
TKlkLwYGTbrYwK.vbe
fontreview.exe
Bootstrapper.exe
Registry.exe.log
powershell.exe.log
SolaraBootstrapper.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Boostraper.bat
Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.WinForms.dll
Microsoft.Web.WebView2.Wpf.dll
.nycrc
.eslintrc
.nycrc
LICENSE
Newtonsoft.Json.dll
WebView2Loader.dll
Wpf.Ui.dll
path.txt
cd57e4c171d6e8f5ea8b8f824a6a7316.dll
cd57e4c171d6e8f5ea8b8f824a6a7316.dll
cd57e4c171d6e8f5ea8b8f824a6a7316.exe
libcurl.dll
vcruntime140.dll
zlib1.dll
SolaraBootstrapper.exe
__PSScriptPolicyTest_d3viemxq.tyv.ps1
Bootstrapper.exe
memory/400-1667-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1630-0x000001394FE80000-0x00000139503BC000-memory.dmp
memory/400-1633-0x000001394FBB0000-0x000001394FC62000-memory.dmp
memory/400-1679-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1677-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1635-0x000001394F920000-0x000001394F92E000-memory.dmp
memory/400-1637-0x00000139506C0000-0x000001395073E000-memory.dmp
memory/400-1676-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1675-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1674-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1673-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1648-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1672-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1665-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1659-0x000001394FE60000-0x000001394FE6E000-memory.dmp
memory/400-1650-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1669-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1668-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1631-0x000001394FAF0000-0x000001394FBAA000-memory.dmp
memory/400-1657-0x000001394FDE0000-0x000001394FDE8000-memory.dmp
memory/400-1628-0x00000139352D0000-0x00000139352EA000-memory.dmp
memory/400-1651-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1649-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1661-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1666-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/400-1658-0x0000013954BA0000-0x0000013954BD8000-memory.dmp
memory/400-1664-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/1952-74-0x0000000000F30000-0x0000000000F46000-memory.dmp
memory/1952-1662-0x00007FF849CA3000-0x00007FF849CA5000-memory.dmp
memory/1952-1663-0x00007FF849CA0000-0x00007FF84A761000-memory.dmp
memory/1952-68-0x00007FF849CA3000-0x00007FF849CA5000-memory.dmp
memory/1952-121-0x00007FF849CA0000-0x00007FF84A761000-memory.dmp
memory/3348-0-0x0000000000400000-0x0000000000656000-memory.dmp
memory/3352-102-0x0000000000CD0000-0x0000000000CDA000-memory.dmp
memory/3352-112-0x00000000056A0000-0x00000000056AA000-memory.dmp
memory/3352-168-0x00000000061A0000-0x00000000061B2000-memory.dmp
memory/3816-127-0x000001B06C1F0000-0x000001B06C212000-memory.dmp
memory/3940-86-0x0000000000400000-0x0000000000422000-memory.dmp
memory/4616-117-0x0000000000C40000-0x0000000000D52000-memory.dmp
memory/4616-119-0x0000000001520000-0x000000000152E000-memory.dmp