Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-07-2024 23:45

General

  • Target

    865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe

  • Size

    784KB

  • MD5

    46a0e2b153610307b9e60b7a799e452e

  • SHA1

    c97dddaa1d48cd01cf7d7172cce619db86bc037f

  • SHA256

    865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a

  • SHA512

    d3139a243ea3d067b0ae64c432ed08911fa0fb14e174ab5a499556a428b03496d90b1ef64f2a72ec6ab74f31c3544755cb041db8de99daa69a6ad97ea2cf949e

  • SSDEEP

    12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 3 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe
    "C:\Users\Admin\AppData\Local\Temp\865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4016
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\StartMenuExperienceHost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4924
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\StartMenuExperienceHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3120
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\CloudNotifications\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:264
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\SearchApp.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3192
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\WsmSvc\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:5008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\StartMenuExperienceHost.exe

    Filesize

    784KB

    MD5

    46a0e2b153610307b9e60b7a799e452e

    SHA1

    c97dddaa1d48cd01cf7d7172cce619db86bc037f

    SHA256

    865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a

    SHA512

    d3139a243ea3d067b0ae64c432ed08911fa0fb14e174ab5a499556a428b03496d90b1ef64f2a72ec6ab74f31c3544755cb041db8de99daa69a6ad97ea2cf949e

  • memory/4016-14-0x000000001BBC0000-0x000000001BBC8000-memory.dmp

    Filesize

    32KB

  • memory/4016-1-0x0000000000EF0000-0x0000000000FBA000-memory.dmp

    Filesize

    808KB

  • memory/4016-5-0x000000001BB30000-0x000000001BB40000-memory.dmp

    Filesize

    64KB

  • memory/4016-6-0x000000001BB40000-0x000000001BB48000-memory.dmp

    Filesize

    32KB

  • memory/4016-7-0x000000001BB50000-0x000000001BB5C000-memory.dmp

    Filesize

    48KB

  • memory/4016-8-0x000000001BB60000-0x000000001BB6A000-memory.dmp

    Filesize

    40KB

  • memory/4016-3-0x00007FFD76230000-0x00007FFD76CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-2-0x0000000003240000-0x0000000003248000-memory.dmp

    Filesize

    32KB

  • memory/4016-9-0x000000001BB70000-0x000000001BB7A000-memory.dmp

    Filesize

    40KB

  • memory/4016-11-0x000000001BB90000-0x000000001BB98000-memory.dmp

    Filesize

    32KB

  • memory/4016-10-0x000000001BB80000-0x000000001BB88000-memory.dmp

    Filesize

    32KB

  • memory/4016-12-0x000000001BBA0000-0x000000001BBA8000-memory.dmp

    Filesize

    32KB

  • memory/4016-122-0x00007FFD76230000-0x00007FFD76CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-4-0x0000000003250000-0x0000000003258000-memory.dmp

    Filesize

    32KB

  • memory/4016-19-0x000000001BD20000-0x000000001BD28000-memory.dmp

    Filesize

    32KB

  • memory/4016-18-0x000000001BC00000-0x000000001BC08000-memory.dmp

    Filesize

    32KB

  • memory/4016-20-0x000000001BD30000-0x000000001BD38000-memory.dmp

    Filesize

    32KB

  • memory/4016-21-0x000000001BD40000-0x000000001BD4C000-memory.dmp

    Filesize

    48KB

  • memory/4016-17-0x000000001BBF0000-0x000000001BBF8000-memory.dmp

    Filesize

    32KB

  • memory/4016-16-0x000000001BBE0000-0x000000001BBE8000-memory.dmp

    Filesize

    32KB

  • memory/4016-22-0x000000001BD50000-0x000000001BD58000-memory.dmp

    Filesize

    32KB

  • memory/4016-15-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

    Filesize

    32KB

  • memory/4016-25-0x00007FFD76230000-0x00007FFD76CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-26-0x00007FFD76230000-0x00007FFD76CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-36-0x00007FFD76230000-0x00007FFD76CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-0-0x00007FFD76233000-0x00007FFD76235000-memory.dmp

    Filesize

    8KB

  • memory/4016-49-0x00007FFD76230000-0x00007FFD76CF1000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-13-0x000000001BBB0000-0x000000001BBB8000-memory.dmp

    Filesize

    32KB