Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-07-2024 09:00

General

  • Target

    nursultan alpha.exe

  • Size

    2.1MB

  • MD5

    5a7e4da699bce68005b413cdd318e9de

  • SHA1

    cee6614980f50810d19c3c18d242d97400078a75

  • SHA256

    b27372b955d8e6cf46a3d36826511468504f8d58b5f24720351bf85f123cfea5

  • SHA512

    7dafdd1ba9941b2f332f596ceefb6e9e07768f63586a4a21b4a31bbe66b890e62935a38e82a7665b1154c66fe015b4ff68144885389fdc4318670f8c878cad3c

  • SSDEEP

    49152:UbA30/p0cfOZx9yRLMjyDYfG0TssZGe4lbY:UbTbfO40r3TssTgY

Score
10/10

Malware Config

Signatures

  • DcRat 14 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\nursultan alpha.exe
    "C:\Users\Admin\AppData\Local\Temp\nursultan alpha.exe"
    1⤵
    • DcRat
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:168
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\AgentDriversavesrefmonitor\cN02MCsoKlkD.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\AgentDriversavesrefmonitor\KXGsF5yeLPYE.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\AgentDriversavesrefmonitor\browserFontdll.exe
          "C:\AgentDriversavesrefmonitor\browserFontdll.exe"
          4⤵
          • DcRat
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2572
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fvEHEwzTUV.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4108
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:5060
              • C:\Windows\PolicyDefinitions\es-ES\unsecapp.exe
                "C:\Windows\PolicyDefinitions\es-ES\unsecapp.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:1720
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\AgentDriversavesrefmonitor\file.vbs"
        2⤵
          PID:4984
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Windows\PLA\cmd.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4480
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\PLA\cmd.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4876
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\PLA\cmd.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3164
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\root\rsod\spoolsv.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:760
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\rsod\spoolsv.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:444
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\root\rsod\spoolsv.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3316
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Windows\PolicyDefinitions\es-ES\unsecapp.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4084
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\es-ES\unsecapp.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:800
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\PolicyDefinitions\es-ES\unsecapp.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4572
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\Offline\sihost.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1536
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\sihost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5100
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\Offline\sihost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2772
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:4048

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\AgentDriversavesrefmonitor\KXGsF5yeLPYE.bat

          Filesize

          50B

          MD5

          fdee2979f8de0e9a4a11bfecb268b97a

          SHA1

          2cdf74132e975745894a81db47814ff38e43a71c

          SHA256

          9bf130c323cb7fee0ab32dfdd9e4065ede767babd5f763e96ebbe5f09f577028

          SHA512

          281be0377447c63debf6d35b52a21c9b193ada7b9c153685cf99963d31dcff89070f167477be99f5fd959be1894bd59725023c1b1c1f5078fadecade14ca7557

        • C:\AgentDriversavesrefmonitor\browserFontdll.exe

          Filesize

          1.8MB

          MD5

          692f6967406106fc784223f04ec69b8c

          SHA1

          e6e174a86f9df6041a00d38f2b39506456f60602

          SHA256

          424468b014466c994112ec496e18fd5d7a693b28b411c0ca52229704cd2ef574

          SHA512

          14f14d50e76c2c179cb3c2b1ea1861fe0776b8eb7cb5798b277a1bf7fca2cd11e79a3355d28c36130deb4a916e462e314b38b346f7069ca86d765826ff14408f

        • C:\AgentDriversavesrefmonitor\cN02MCsoKlkD.vbe

          Filesize

          215B

          MD5

          a732935b7511a789de0a7fe84b991d42

          SHA1

          b99ae053d5df9684f12da7ad90e6e8a56c9d0b4e

          SHA256

          b686a1c9ece16e8bf2e95a769128b30c047f14413dadddfc422f288dd6e8aa99

          SHA512

          e9b249a2419e5dbdd0e9cfd238f1f6e1559bdd1efc0264d52b4f4bb5fa10b128138a54d2060cecab4f62f815fafc952329a1e8377b756fd8178e4f41d87273d1

        • C:\AgentDriversavesrefmonitor\file.vbs

          Filesize

          34B

          MD5

          677cc4360477c72cb0ce00406a949c61

          SHA1

          b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

          SHA256

          f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

          SHA512

          7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

        • C:\Users\Admin\AppData\Local\Temp\fvEHEwzTUV.bat

          Filesize

          212B

          MD5

          0f53b12e0a9936a2eae81863bcde8994

          SHA1

          0e28cff0e08af514fd688cf33cadd0d3b73361e2

          SHA256

          3616d7adfca2257eb39d813b298a365414423241a4374809c77bfe64a66584b8

          SHA512

          14ac6d017f6bc061c2ad8839dfe3e93816829305fed7886e930c2b6626aa57d94b642e82a509bce8b701f070e01637a6fb4ac49b2dab3c19e5dec2e2eba4b0ee

        • memory/1720-40-0x000000001BF20000-0x000000001BF76000-memory.dmp

          Filesize

          344KB

        • memory/1720-41-0x0000000001400000-0x000000000141C000-memory.dmp

          Filesize

          112KB

        • memory/1720-42-0x0000000001470000-0x00000000014C0000-memory.dmp

          Filesize

          320KB

        • memory/2572-19-0x00000000007A0000-0x0000000000978000-memory.dmp

          Filesize

          1.8MB

        • memory/2572-20-0x0000000002BA0000-0x0000000002BF6000-memory.dmp

          Filesize

          344KB

        • memory/2572-21-0x00000000029D0000-0x00000000029D8000-memory.dmp

          Filesize

          32KB

        • memory/2572-22-0x00000000029E0000-0x00000000029E8000-memory.dmp

          Filesize

          32KB