Analysis

  • max time kernel
    104s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-07-2024 09:38

General

  • Target

    a57378db4d26609de5f519dd2659ae60N.exe

  • Size

    784KB

  • MD5

    a57378db4d26609de5f519dd2659ae60

  • SHA1

    56f0f96c01ca12792cea6b7ea0814f0f568fe095

  • SHA256

    cb667550264f5028045377419da9a935006e09b136ebe69a409a520dbf8db587

  • SHA512

    6bfa4635da5753f2713c826ade75910bd0d8488915c8b80e5893b52c7c8696538edb5d4a4fba68636b1a92de6d487a184fabafb945ee35eecb6015bf4163cf33

  • SSDEEP

    12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 5 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a57378db4d26609de5f519dd2659ae60N.exe
    "C:\Users\Admin\AppData\Local\Temp\a57378db4d26609de5f519dd2659ae60N.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4876
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OXh4IkWU9A.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:2428
        • C:\ProgramData\Desktop\a57378db4d26609de5f519dd2659ae60N.exe
          "C:\ProgramData\Desktop\a57378db4d26609de5f519dd2659ae60N.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:3316
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "a57378db4d26609de5f519dd2659ae60N" /sc ONLOGON /tr "'C:\ProgramData\Desktop\a57378db4d26609de5f519dd2659ae60N.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4036
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\backgroundTaskHost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2384
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\splwow64\sysmon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4416
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\cleanmgr\sihost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:624
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\My Documents\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1368

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a57378db4d26609de5f519dd2659ae60N.exe.log

      Filesize

      1KB

      MD5

      b7c0c43fc7804baaa7dc87152cdc9554

      SHA1

      1bab62bd56af745678d4e967d91e1ccfdeed4038

      SHA256

      46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457

      SHA512

      9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769

    • C:\Users\Admin\AppData\Local\Temp\OXh4IkWU9A.bat

      Filesize

      224B

      MD5

      a01cb2045dfe6434f6ef7833b850c3b1

      SHA1

      7e08a73864ae0f51da3c3c58da43a8ef41e07b02

      SHA256

      57508272382617d73c58d03d4a7fad023f8fa09fb6f5956e530bf6b8097ce843

      SHA512

      bd8590649e3064d2d096dbb41677720797375fc93d0e15c4e761ffb3fa89f388f3a0196346e914da602daae49ab8ec210ba9b0741c6265bafc829c1cbb511185

    • C:\Users\Default\Documents\dllhost.exe

      Filesize

      784KB

      MD5

      a57378db4d26609de5f519dd2659ae60

      SHA1

      56f0f96c01ca12792cea6b7ea0814f0f568fe095

      SHA256

      cb667550264f5028045377419da9a935006e09b136ebe69a409a520dbf8db587

      SHA512

      6bfa4635da5753f2713c826ade75910bd0d8488915c8b80e5893b52c7c8696538edb5d4a4fba68636b1a92de6d487a184fabafb945ee35eecb6015bf4163cf33

    • memory/4876-18-0x000000001B0C0000-0x000000001B0C8000-memory.dmp

      Filesize

      32KB

    • memory/4876-20-0x000000001B200000-0x000000001B208000-memory.dmp

      Filesize

      32KB

    • memory/4876-5-0x000000001AEF0000-0x000000001AF00000-memory.dmp

      Filesize

      64KB

    • memory/4876-6-0x000000001AF00000-0x000000001AF08000-memory.dmp

      Filesize

      32KB

    • memory/4876-7-0x000000001AF10000-0x000000001AF1C000-memory.dmp

      Filesize

      48KB

    • memory/4876-9-0x000000001AF20000-0x000000001AF2A000-memory.dmp

      Filesize

      40KB

    • memory/4876-11-0x000000001B080000-0x000000001B088000-memory.dmp

      Filesize

      32KB

    • memory/4876-10-0x000000001AF40000-0x000000001AF48000-memory.dmp

      Filesize

      32KB

    • memory/4876-12-0x000000001AF50000-0x000000001AF58000-memory.dmp

      Filesize

      32KB

    • memory/4876-13-0x000000001B090000-0x000000001B098000-memory.dmp

      Filesize

      32KB

    • memory/4876-14-0x000000001AF60000-0x000000001AF68000-memory.dmp

      Filesize

      32KB

    • memory/4876-0-0x00007FFB1E2C3000-0x00007FFB1E2C5000-memory.dmp

      Filesize

      8KB

    • memory/4876-17-0x000000001B0E0000-0x000000001B0E8000-memory.dmp

      Filesize

      32KB

    • memory/4876-3-0x0000000000D30000-0x0000000000D38000-memory.dmp

      Filesize

      32KB

    • memory/4876-22-0x000000001B230000-0x000000001B238000-memory.dmp

      Filesize

      32KB

    • memory/4876-21-0x000000001B220000-0x000000001B22C000-memory.dmp

      Filesize

      48KB

    • memory/4876-19-0x000000001B1F0000-0x000000001B1F8000-memory.dmp

      Filesize

      32KB

    • memory/4876-16-0x000000001B0B0000-0x000000001B0B8000-memory.dmp

      Filesize

      32KB

    • memory/4876-15-0x000000001B0A0000-0x000000001B0A8000-memory.dmp

      Filesize

      32KB

    • memory/4876-8-0x000000001AF30000-0x000000001AF3A000-memory.dmp

      Filesize

      40KB

    • memory/4876-25-0x00007FFB1E2C0000-0x00007FFB1ED81000-memory.dmp

      Filesize

      10.8MB

    • memory/4876-26-0x00007FFB1E2C0000-0x00007FFB1ED81000-memory.dmp

      Filesize

      10.8MB

    • memory/4876-33-0x00007FFB1E2C0000-0x00007FFB1ED81000-memory.dmp

      Filesize

      10.8MB

    • memory/4876-4-0x0000000000D40000-0x0000000000D48000-memory.dmp

      Filesize

      32KB

    • memory/4876-51-0x00007FFB1E2C0000-0x00007FFB1ED81000-memory.dmp

      Filesize

      10.8MB

    • memory/4876-78-0x00007FFB1E2C0000-0x00007FFB1ED81000-memory.dmp

      Filesize

      10.8MB

    • memory/4876-2-0x00007FFB1E2C0000-0x00007FFB1ED81000-memory.dmp

      Filesize

      10.8MB

    • memory/4876-1-0x00000000003B0000-0x000000000047A000-memory.dmp

      Filesize

      808KB