Analysis

  • max time kernel
    31s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21-07-2024 09:38

General

  • Target

    a57378db4d26609de5f519dd2659ae60N.exe

  • Size

    784KB

  • MD5

    a57378db4d26609de5f519dd2659ae60

  • SHA1

    56f0f96c01ca12792cea6b7ea0814f0f568fe095

  • SHA256

    cb667550264f5028045377419da9a935006e09b136ebe69a409a520dbf8db587

  • SHA512

    6bfa4635da5753f2713c826ade75910bd0d8488915c8b80e5893b52c7c8696538edb5d4a4fba68636b1a92de6d487a184fabafb945ee35eecb6015bf4163cf33

  • SSDEEP

    12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 17 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 12 IoCs
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 17 IoCs
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
  • Drops file in System32 directory 30 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • System policy modification 1 TTPs 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a57378db4d26609de5f519dd2659ae60N.exe
    "C:\Users\Admin\AppData\Local\Temp\a57378db4d26609de5f519dd2659ae60N.exe"
    1⤵
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2292
    • C:\Users\Admin\AppData\Local\Temp\a57378db4d26609de5f519dd2659ae60N.exe
      "C:\Users\Admin\AppData\Local\Temp\a57378db4d26609de5f519dd2659ae60N.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2772
      • C:\Users\Admin\AppData\Local\Temp\a57378db4d26609de5f519dd2659ae60N.exe
        "C:\Users\Admin\AppData\Local\Temp\a57378db4d26609de5f519dd2659ae60N.exe"
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1548
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GkAKG2zvN3.bat"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2480
          • C:\Windows\system32\w32tm.exe
            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            5⤵
              PID:2356
            • C:\PerfLogs\Admin\smss.exe
              "C:\PerfLogs\Admin\smss.exe"
              5⤵
              • UAC bypass
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • System policy modification
              PID:2932
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\scrobj\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2832
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Documents and Settings\audiodg.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2776
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2524
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2124
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\KBDSW\lsm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1204
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\ProgramData\Application Data\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1072
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2572
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\C_936\lsm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1732
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons0002\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2028
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\viewprov\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1272
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\ja-JP\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1608
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\lsm\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2164
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\perfi010\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1196
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\p2p-crp\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2952
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\PerfLogs\Admin\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1160
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:692
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\scesrv\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1896

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe

      Filesize

      784KB

      MD5

      fb8104610be9ea8a2ddf11cdc0ce113c

      SHA1

      ebea110bf75e1380c733e1835dc79d40a620ced0

      SHA256

      da388067d60cce1c8d81d2601009e41a08d49a9cd1f5c0499b6f460f90a2d054

      SHA512

      488c1590dc859e97290a24dde2f5b4bf6a0992153ba2d92bf168058c33fcd0724b84ba03bb618f9d4cd770d575889f08d6ad03d48df9dd338a75b37956186904

    • C:\Users\Admin\AppData\Local\Temp\GkAKG2zvN3.bat

      Filesize

      190B

      MD5

      4f19d9fef634fae3c1c390206d0d9385

      SHA1

      e5b912d2523b686a39114495e70567a5e657c5b6

      SHA256

      abaa5299eb02abb2a0f0355fe1be28cc194bc60418b70e970921583b77ab765b

      SHA512

      d98bca6e94e3fc777d2e1fc6a9bf51596232bd9e7d66bea5f93b7690c35ebe464ac71e87a8ee2620f72e0ad8f3f72e7502a1ceafa29c45d802aeec4ce9114673

    • C:\Windows\System32\KBDSW\lsm.exe

      Filesize

      784KB

      MD5

      a57378db4d26609de5f519dd2659ae60

      SHA1

      56f0f96c01ca12792cea6b7ea0814f0f568fe095

      SHA256

      cb667550264f5028045377419da9a935006e09b136ebe69a409a520dbf8db587

      SHA512

      6bfa4635da5753f2713c826ade75910bd0d8488915c8b80e5893b52c7c8696538edb5d4a4fba68636b1a92de6d487a184fabafb945ee35eecb6015bf4163cf33

    • memory/2292-14-0x0000000000D30000-0x0000000000D38000-memory.dmp

      Filesize

      32KB

    • memory/2292-16-0x0000000000D50000-0x0000000000D58000-memory.dmp

      Filesize

      32KB

    • memory/2292-5-0x0000000000270000-0x0000000000280000-memory.dmp

      Filesize

      64KB

    • memory/2292-6-0x0000000000280000-0x0000000000288000-memory.dmp

      Filesize

      32KB

    • memory/2292-7-0x00000000002A0000-0x00000000002AC000-memory.dmp

      Filesize

      48KB

    • memory/2292-8-0x00000000002D0000-0x00000000002DA000-memory.dmp

      Filesize

      40KB

    • memory/2292-9-0x00000000005F0000-0x00000000005FA000-memory.dmp

      Filesize

      40KB

    • memory/2292-10-0x0000000000290000-0x0000000000298000-memory.dmp

      Filesize

      32KB

    • memory/2292-11-0x00000000005E0000-0x00000000005E8000-memory.dmp

      Filesize

      32KB

    • memory/2292-12-0x0000000000B90000-0x0000000000B98000-memory.dmp

      Filesize

      32KB

    • memory/2292-13-0x00000000002C0000-0x00000000002C8000-memory.dmp

      Filesize

      32KB

    • memory/2292-0-0x000007FEF5423000-0x000007FEF5424000-memory.dmp

      Filesize

      4KB

    • memory/2292-17-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

      Filesize

      32KB

    • memory/2292-4-0x0000000000260000-0x0000000000268000-memory.dmp

      Filesize

      32KB

    • memory/2292-15-0x0000000000D60000-0x0000000000D68000-memory.dmp

      Filesize

      32KB

    • memory/2292-18-0x0000000000B80000-0x0000000000B88000-memory.dmp

      Filesize

      32KB

    • memory/2292-19-0x0000000000D80000-0x0000000000D88000-memory.dmp

      Filesize

      32KB

    • memory/2292-20-0x0000000000D90000-0x0000000000D98000-memory.dmp

      Filesize

      32KB

    • memory/2292-21-0x0000000000DC0000-0x0000000000DCC000-memory.dmp

      Filesize

      48KB

    • memory/2292-22-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

      Filesize

      32KB

    • memory/2292-25-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

      Filesize

      9.9MB

    • memory/2292-30-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

      Filesize

      9.9MB

    • memory/2292-3-0x0000000000250000-0x0000000000258000-memory.dmp

      Filesize

      32KB

    • memory/2292-35-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

      Filesize

      9.9MB

    • memory/2292-2-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

      Filesize

      9.9MB

    • memory/2292-98-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

      Filesize

      9.9MB

    • memory/2292-1-0x0000000000FF0000-0x00000000010BA000-memory.dmp

      Filesize

      808KB

    • memory/2932-143-0x00000000009F0000-0x0000000000ABA000-memory.dmp

      Filesize

      808KB