Analysis

  • max time kernel
    598s
  • max time network
    603s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-07-2024 12:35

General

  • Target

    Dast.Hack.exe

  • Size

    3.3MB

  • MD5

    062d2db533784ab458d45b9bbdd59e28

  • SHA1

    66e2ec6e8c6ec3f6d47a4a08eb08790e1f9b80ce

  • SHA256

    8299f38454d692ddb4154b8beda82486d92bbcaec91139a18f70ef476d7d9727

  • SHA512

    335739dd9f92575d5369eb836e04f8aa4a302857cb9e5a9c26ffddd2f5842b77c264341a5963a1efc8b2e63b6490fbd47392ddc712f188a986fcb9499ff4148d

  • SSDEEP

    49152:UbA30MYh4gIPIBXyjBVVIfVl+rf9LTewShH16PScTtMf6ajJPgqk5lZtH:Ub/gQBnoRT6EPS0t66KOlZtH

Malware Config

Signatures

  • DcRat 26 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dast.Hack.exe
    "C:\Users\Admin\AppData\Local\Temp\Dast.Hack.exe"
    1⤵
    • DcRat
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\refcommon\a9qp8YhB09rgym.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1232
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\refcommon\o7w5u18.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2372
        • C:\refcommon\Savesruntimeperf.exe
          "C:\refcommon\Savesruntimeperf.exe"
          4⤵
          • DcRat
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3608
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aGmV56J0l0.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3192
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:2584
              • C:\Users\Admin\sysmon.exe
                "C:\Users\Admin\sysmon.exe"
                6⤵
                • UAC bypass
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:3688
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7713eddd-0f40-46c5-8e92-5d873eaf0ff6.vbs"
                  7⤵
                    PID:2264
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9339de0-b4e6-4f83-90d4-ec96ba79574d.vbs"
                    7⤵
                      PID:4744
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\dllhost.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1668
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Google\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2348
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:380
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\sysmon.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4664
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Admin\sysmon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4256
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\sysmon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4948
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\en-US\ShellExperienceHost.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3888
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\en-US\ShellExperienceHost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3196
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\en-US\ShellExperienceHost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4188
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3000
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4752
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4776
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\winlogon.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2284
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Performance\winlogon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2276
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\Performance\winlogon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4548
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\sysmon.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:5040
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\sysmon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4472
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\sysmon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4388
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4584
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:392
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4612
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\RuntimeBroker.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2448
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4768
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2664
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2288
        • C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe
          "C:\Program Files (x86)\Mozilla Maintenance Service\logs\explorer.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1416
        • C:\Program Files\Common Files\microsoft shared\Triedit\sysmon.exe
          "C:\Program Files\Common Files\microsoft shared\Triedit\sysmon.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2300
        • C:\Program Files\Windows Mail\en-US\ShellExperienceHost.exe
          "C:\Program Files\Windows Mail\en-US\ShellExperienceHost.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1868
        • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\RuntimeBroker.exe
          "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\RuntimeBroker.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3868

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\7713eddd-0f40-46c5-8e92-5d873eaf0ff6.vbs

          Filesize

          701B

          MD5

          1e6b4b17995bb9b5cf16640ca78a6ed5

          SHA1

          0febbcf10da6c32c5d6f5d57085e724ee9a73153

          SHA256

          d0c56b4fcd5e99fcc3c05aaefef2f338fb3cd74ecbf8ca0893ee0019e243f947

          SHA512

          5d0b085c351ccc41fc2d826217af3a7ec92ce75a14f33002effbb501cfe153de10b8617f411fd0a433f098cb897aa6bf7a391d6d2000602bab6ff3e7ce91161e

        • C:\Users\Admin\AppData\Local\Temp\a9339de0-b4e6-4f83-90d4-ec96ba79574d.vbs

          Filesize

          477B

          MD5

          5fecf589c3354566a4a8b4916ec517a5

          SHA1

          5ee5a7da2e97e695430fe362c228da5d8f5f06af

          SHA256

          db9059a2a2e3c96a324e9cdabd78ad0a00d4cce4ab6b3a3b209f8b49b406647f

          SHA512

          140f1779f1854fd0b3b9914bdbd500b7f08de305c7be72e85ad56807c33a29e4195284e5f0c1974dbfe0fa40e50b4a81d84ff9a61d91abc72e2c3a2dedcf0898

        • C:\Users\Admin\AppData\Local\Temp\aGmV56J0l0.bat

          Filesize

          190B

          MD5

          0a06dbba175d7edccc94d544bc1897d8

          SHA1

          9ece6924d9a18c6977dd75f5e70eed31657ad977

          SHA256

          21a7702760538d02f267ebe43f9c84e9a2ab1bda219053ec8195e4d88b2fe17e

          SHA512

          6d1096192a3bd5d38a67b78d4683888e4e2f20f5d796736a46ce33fcbbf8d23d1a2405ac0b59b6ea564821ad4920c33021393940ee977d7728fbb441d8c1e651

        • C:\refcommon\Savesruntimeperf.exe

          Filesize

          3.0MB

          MD5

          17babc686738c7b611b9e9e028c8ef34

          SHA1

          8c959decebcb5544528e2a76f66e73c401e19be8

          SHA256

          7cef1a964acbe38f4796b9ddbbd95e3fc19215594b2f3ab74483d58fe4bb93ad

          SHA512

          c7e2f881e6eb09e25c08c76b88b7626c768fb3e623b39b538e7b84f02fb6382bf5b4e0d66835c63cf59d1346e91b5bc3b60a6335bab90d5f185d81e5f9a52fe8

        • C:\refcommon\a9qp8YhB09rgym.vbe

          Filesize

          193B

          MD5

          e30dc1038a7664ab0f9623335243517e

          SHA1

          9466920ec01f531bac1f482635d03015c5d9981a

          SHA256

          28103167be9475e1971ef47b77f1d115f814f1635060d2ce6e0d64f1ddf63300

          SHA512

          f02d8034d9fbb2685540179f5d79f54dff68d73c7ed838999b49a9de67efd5385d1b51f1e4f81425ad126ef587de3096988c917069dc0beb71bef999cb8b36b3

        • C:\refcommon\o7w5u18.bat

          Filesize

          35B

          MD5

          23a21c6fd0af23b3a6b196ed1300a37c

          SHA1

          247e674129a0414018bcb7b2aa5e12d4a2005f05

          SHA256

          87957d0707f5768d0e6c920bfba23d2693189131d57418e04344153332555082

          SHA512

          2cbfb8549d4ae49759ef9b5caaee02609cb1496f16e58d4bb2c28001ae2ed21a4a53cc06d47d9133164dde64f2e765c5a99f4ad0cdd25cc92442cf4a9aefc95c

        • memory/3608-29-0x0000000002AD0000-0x0000000002AD8000-memory.dmp

          Filesize

          32KB

        • memory/3608-31-0x0000000002AF0000-0x0000000002AF8000-memory.dmp

          Filesize

          32KB

        • memory/3608-19-0x000000001B9A0000-0x000000001B9F0000-memory.dmp

          Filesize

          320KB

        • memory/3608-20-0x0000000002980000-0x0000000002988000-memory.dmp

          Filesize

          32KB

        • memory/3608-21-0x0000000002990000-0x00000000029A0000-memory.dmp

          Filesize

          64KB

        • memory/3608-22-0x0000000002B00000-0x0000000002B16000-memory.dmp

          Filesize

          88KB

        • memory/3608-23-0x00000000029A0000-0x00000000029A8000-memory.dmp

          Filesize

          32KB

        • memory/3608-24-0x0000000002B30000-0x0000000002B42000-memory.dmp

          Filesize

          72KB

        • memory/3608-25-0x0000000002B20000-0x0000000002B30000-memory.dmp

          Filesize

          64KB

        • memory/3608-26-0x0000000002B40000-0x0000000002B4A000-memory.dmp

          Filesize

          40KB

        • memory/3608-27-0x000000001B9F0000-0x000000001BA46000-memory.dmp

          Filesize

          344KB

        • memory/3608-28-0x0000000002AC0000-0x0000000002ACC000-memory.dmp

          Filesize

          48KB

        • memory/3608-17-0x0000000001050000-0x0000000001058000-memory.dmp

          Filesize

          32KB

        • memory/3608-30-0x0000000002AE0000-0x0000000002AEC000-memory.dmp

          Filesize

          48KB

        • memory/3608-32-0x0000000002B50000-0x0000000002B62000-memory.dmp

          Filesize

          72KB

        • memory/3608-18-0x0000000001060000-0x000000000107C000-memory.dmp

          Filesize

          112KB

        • memory/3608-33-0x000000001C220000-0x000000001C746000-memory.dmp

          Filesize

          5.1MB

        • memory/3608-34-0x000000001B350000-0x000000001B358000-memory.dmp

          Filesize

          32KB

        • memory/3608-35-0x000000001B360000-0x000000001B368000-memory.dmp

          Filesize

          32KB

        • memory/3608-39-0x000000001BA50000-0x000000001BA58000-memory.dmp

          Filesize

          32KB

        • memory/3608-40-0x000000001BA60000-0x000000001BA6A000-memory.dmp

          Filesize

          40KB

        • memory/3608-38-0x000000001BA40000-0x000000001BA48000-memory.dmp

          Filesize

          32KB

        • memory/3608-37-0x000000001B380000-0x000000001B38E000-memory.dmp

          Filesize

          56KB

        • memory/3608-36-0x000000001B370000-0x000000001B37A000-memory.dmp

          Filesize

          40KB

        • memory/3608-41-0x000000001BA70000-0x000000001BA7C000-memory.dmp

          Filesize

          48KB

        • memory/3608-16-0x0000000000E30000-0x0000000000E3E000-memory.dmp

          Filesize

          56KB

        • memory/3608-14-0x0000000000380000-0x0000000000680000-memory.dmp

          Filesize

          3.0MB

        • memory/3608-15-0x0000000000E20000-0x0000000000E2E000-memory.dmp

          Filesize

          56KB

        • memory/3688-68-0x000000001BA00000-0x000000001BA56000-memory.dmp

          Filesize

          344KB

        • memory/3688-67-0x0000000002EE0000-0x0000000002EF2000-memory.dmp

          Filesize

          72KB