Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 15:06
Behavioral task
behavioral1
Sample
6e4e01af6b88116f0c7331bba5e7b782.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6e4e01af6b88116f0c7331bba5e7b782.exe
Resource
win10v2004-20240709-en
General
-
Target
6e4e01af6b88116f0c7331bba5e7b782.exe
-
Size
2.0MB
-
MD5
6e4e01af6b88116f0c7331bba5e7b782
-
SHA1
756c0a5ea8aac86f41d118166452a011a608043c
-
SHA256
5a335f4ea90b29144cf268dccdc8f8e1757e57cccc941cc7334b8f4bd7999147
-
SHA512
f49b6146f313624606a9eb80287c23c68aaefcf7ffafacba83a87b333b4388dd38a423a179b7bcb0e1d555873681b405c781faf68e2d7169fa7bcefe4a73874b
-
SSDEEP
24576:jYe7C5QSBzoU/n15NuQtG+7IwzwT2wLqq12OBOa2WYO3QFSBztYSqEEU5oZUSzTO:jYemPM0tvmwGBF223ZztBqEqx9v
Malware Config
Signatures
-
DcRat 12 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2528 schtasks.exe 2632 schtasks.exe 2536 schtasks.exe 2660 schtasks.exe 2644 schtasks.exe 2624 schtasks.exe 784 schtasks.exe 2792 schtasks.exe 2540 schtasks.exe 2492 schtasks.exe 2104 schtasks.exe 2704 schtasks.exe -
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Links\\services.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\services.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Links\\services.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\dwm.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Links\\services.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Links\\services.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe -
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 784 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2632 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2704 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2104 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2528 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2792 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2540 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2492 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 2920 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2660 2920 schtasks.exe -
Processes:
resource yara_rule behavioral1/memory/2940-1-0x00000000008C0000-0x0000000000ACE000-memory.dmp dcrat C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwm.exe dcrat behavioral1/memory/2224-26-0x00000000000C0000-0x00000000002CE000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
dwm.exepid process 2224 dwm.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Admin\\Links\\services.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Admin\\Links\\services.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\services.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\services.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\dwm.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\dwm.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Mail\\WmiPrvSE.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Drops file in Program Files directory 4 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription ioc process File created C:\Program Files (x86)\MSBuild\Microsoft\services.exe 6e4e01af6b88116f0c7331bba5e7b782.exe File created C:\Program Files (x86)\MSBuild\Microsoft\c5b4cb5e9653cc 6e4e01af6b88116f0c7331bba5e7b782.exe File created C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe 6e4e01af6b88116f0c7331bba5e7b782.exe File created C:\Program Files (x86)\Windows Mail\24dbde2999530e 6e4e01af6b88116f0c7331bba5e7b782.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2528 schtasks.exe 2492 schtasks.exe 2536 schtasks.exe 784 schtasks.exe 2644 schtasks.exe 2624 schtasks.exe 2792 schtasks.exe 2540 schtasks.exe 2660 schtasks.exe 2632 schtasks.exe 2704 schtasks.exe 2104 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedwm.exepid process 2940 6e4e01af6b88116f0c7331bba5e7b782.exe 2940 6e4e01af6b88116f0c7331bba5e7b782.exe 2940 6e4e01af6b88116f0c7331bba5e7b782.exe 2940 6e4e01af6b88116f0c7331bba5e7b782.exe 2940 6e4e01af6b88116f0c7331bba5e7b782.exe 2940 6e4e01af6b88116f0c7331bba5e7b782.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe 2224 dwm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedwm.exedescription pid process Token: SeDebugPrivilege 2940 6e4e01af6b88116f0c7331bba5e7b782.exe Token: SeDebugPrivilege 2224 dwm.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.execmd.exedescription pid process target process PID 2940 wrote to memory of 2148 2940 6e4e01af6b88116f0c7331bba5e7b782.exe cmd.exe PID 2940 wrote to memory of 2148 2940 6e4e01af6b88116f0c7331bba5e7b782.exe cmd.exe PID 2940 wrote to memory of 2148 2940 6e4e01af6b88116f0c7331bba5e7b782.exe cmd.exe PID 2148 wrote to memory of 1664 2148 cmd.exe w32tm.exe PID 2148 wrote to memory of 1664 2148 cmd.exe w32tm.exe PID 2148 wrote to memory of 1664 2148 cmd.exe w32tm.exe PID 2148 wrote to memory of 2224 2148 cmd.exe dwm.exe PID 2148 wrote to memory of 2224 2148 cmd.exe dwm.exe PID 2148 wrote to memory of 2224 2148 cmd.exe dwm.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e4e01af6b88116f0c7331bba5e7b782.exe"C:\Users\Admin\AppData\Local\Temp\6e4e01af6b88116f0c7331bba5e7b782.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZqalLIBQEe.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:1664
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwm.exe"C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwm.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Links\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Links\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Links\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD56e4e01af6b88116f0c7331bba5e7b782
SHA1756c0a5ea8aac86f41d118166452a011a608043c
SHA2565a335f4ea90b29144cf268dccdc8f8e1757e57cccc941cc7334b8f4bd7999147
SHA512f49b6146f313624606a9eb80287c23c68aaefcf7ffafacba83a87b333b4388dd38a423a179b7bcb0e1d555873681b405c781faf68e2d7169fa7bcefe4a73874b
-
Filesize
240B
MD5108d306d56821bd0b172344fe3200e3d
SHA1a6ad723a96e77ba9d1c8c2a1c6992ef90d0ac36a
SHA256b79e9c311c4d9ec72eddd294c01b78bc0d14dff7090d57bcaf01d71b0a591a60
SHA512e57f38529e77afd5269e2474ca4fe1c34e763b2dce9ec243ecc36c9906ec110425a8b00fb0447ae12bd98118c6a0ee696f9e5fb4e6574cc0760169ae698c5718