Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-07-2024 09:06

General

  • Target

    3DEF0AE25D7785E4155D73639281C783.exe

  • Size

    3.0MB

  • MD5

    3def0ae25d7785e4155d73639281c783

  • SHA1

    83e0bd5e952c0d8501f0bae856ad057d2d66f933

  • SHA256

    9c8937d1ffc2a8ce23cbaddaa9e8b046d1460fc684d05b609fec3514ab14c39c

  • SHA512

    beac32faa42d72af9eb64977c2ed8aa30ec0d78a3319a758378a6c407a951919a9539b22b2595f91953b25109bd185e33798c09590c9fbbfee7618771ad1edf4

  • SSDEEP

    49152:Mj0QvSoTm+SLllhsAKVSPwAk6roAIJiUhykd8zKflQ5TpweOBw7bMoc52Sf0:MpacpSLllnKsPfxro1hh9ApQ+br0nf0

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3DEF0AE25D7785E4155D73639281C783.exe
    "C:\Users\Admin\AppData\Local\Temp\3DEF0AE25D7785E4155D73639281C783.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3832
    • C:\Windows\Containers\OfficeClickToRun.exe
      "C:\Windows\Containers\OfficeClickToRun.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2988
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce77732b-ebd4-4d73-ae70-362f59c42b35.vbs"
        3⤵
          PID:1236
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df5c5cd3-a3e6-4317-be4a-e8be294c40a8.vbs"
          3⤵
            PID:2024
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2404
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2428
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4200
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jdk-1.8\backgroundTaskHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3520
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\backgroundTaskHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2092
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk-1.8\backgroundTaskHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2916
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4108
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1852
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2424
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Windows\Logs\NetSetup\sysmon.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1716
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Logs\NetSetup\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:668
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Windows\Logs\NetSetup\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1256
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre-1.8\SearchApp.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:700
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\SearchApp.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5100
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jre-1.8\SearchApp.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3420
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\OfficeClickToRun.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3128
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1940
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3956
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:768
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1732
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3264
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\sysmon.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4344
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4024
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4000
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Windows\Containers\OfficeClickToRun.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:516
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Containers\OfficeClickToRun.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2496
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Windows\Containers\OfficeClickToRun.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3752
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:780
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
          PID:1716

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Java\jre-1.8\SearchApp.exe

          Filesize

          3.0MB

          MD5

          3def0ae25d7785e4155d73639281c783

          SHA1

          83e0bd5e952c0d8501f0bae856ad057d2d66f933

          SHA256

          9c8937d1ffc2a8ce23cbaddaa9e8b046d1460fc684d05b609fec3514ab14c39c

          SHA512

          beac32faa42d72af9eb64977c2ed8aa30ec0d78a3319a758378a6c407a951919a9539b22b2595f91953b25109bd185e33798c09590c9fbbfee7618771ad1edf4

        • C:\Users\Admin\AppData\Local\Temp\ce77732b-ebd4-4d73-ae70-362f59c42b35.vbs

          Filesize

          718B

          MD5

          ce16bced6c0725cb2447ba3d40105a23

          SHA1

          6985bc804836b9a0815ce3deea8ea99764d69499

          SHA256

          0002148d62ab50246952101552c547ae9f55f49f433b1a7c9b17707afbb8c744

          SHA512

          5d25827cafdd0c09ffd04ff7a2e92b154cbad192bf0538306183efd861c076362f6852866e4107ab9fd7088957658889a015f0b1b58b6df74000a62a50f2a984

        • C:\Users\Admin\AppData\Local\Temp\df5c5cd3-a3e6-4317-be4a-e8be294c40a8.vbs

          Filesize

          494B

          MD5

          cf0d1fa108230f5efc5fd6caaa12b5d9

          SHA1

          b3adb87aaceab1c809b097ae84b14fce46ea68ac

          SHA256

          f443d8d3f68ec6a948e6bdc492ec2cc089d96c06557ee27560d2f12dcf0827ac

          SHA512

          17e4f2f13d3afb44b644a01c01b2c3be817c7bea89fc305c63a4a9d00763130afaa311a37e576556423dcb3d6df2fd885ee20d7c8af74cf8b3326f02247fb5e6

        • memory/3832-17-0x000000001BB00000-0x000000001BB08000-memory.dmp

          Filesize

          32KB

        • memory/3832-7-0x0000000002820000-0x0000000002828000-memory.dmp

          Filesize

          32KB

        • memory/3832-4-0x0000000002810000-0x0000000002818000-memory.dmp

          Filesize

          32KB

        • memory/3832-19-0x000000001C0E0000-0x000000001C608000-memory.dmp

          Filesize

          5.2MB

        • memory/3832-10-0x000000001BA10000-0x000000001BA1C000-memory.dmp

          Filesize

          48KB

        • memory/3832-9-0x000000001B9F0000-0x000000001BA06000-memory.dmp

          Filesize

          88KB

        • memory/3832-8-0x0000000002860000-0x0000000002870000-memory.dmp

          Filesize

          64KB

        • memory/3832-20-0x000000001BB40000-0x000000001BB4C000-memory.dmp

          Filesize

          48KB

        • memory/3832-11-0x000000001BA20000-0x000000001BA28000-memory.dmp

          Filesize

          32KB

        • memory/3832-12-0x000000001BBA0000-0x000000001BBAA000-memory.dmp

          Filesize

          40KB

        • memory/3832-13-0x000000001BA90000-0x000000001BAE6000-memory.dmp

          Filesize

          344KB

        • memory/3832-14-0x000000001BA30000-0x000000001BA3C000-memory.dmp

          Filesize

          48KB

        • memory/3832-15-0x000000001BAE0000-0x000000001BAE8000-memory.dmp

          Filesize

          32KB

        • memory/3832-21-0x000000001BB50000-0x000000001BB5C000-memory.dmp

          Filesize

          48KB

        • memory/3832-18-0x000000001BB10000-0x000000001BB22000-memory.dmp

          Filesize

          72KB

        • memory/3832-0-0x00007FFBF7A63000-0x00007FFBF7A65000-memory.dmp

          Filesize

          8KB

        • memory/3832-6-0x000000001BA40000-0x000000001BA90000-memory.dmp

          Filesize

          320KB

        • memory/3832-5-0x0000000002840000-0x000000000285C000-memory.dmp

          Filesize

          112KB

        • memory/3832-16-0x000000001BAF0000-0x000000001BAFC000-memory.dmp

          Filesize

          48KB

        • memory/3832-22-0x000000001BB60000-0x000000001BB6C000-memory.dmp

          Filesize

          48KB

        • memory/3832-23-0x000000001BB80000-0x000000001BB88000-memory.dmp

          Filesize

          32KB

        • memory/3832-25-0x000000001BB90000-0x000000001BB9E000-memory.dmp

          Filesize

          56KB

        • memory/3832-24-0x000000001BB70000-0x000000001BB7A000-memory.dmp

          Filesize

          40KB

        • memory/3832-30-0x000000001BEF0000-0x000000001BEFA000-memory.dmp

          Filesize

          40KB

        • memory/3832-29-0x000000001BDE0000-0x000000001BDE8000-memory.dmp

          Filesize

          32KB

        • memory/3832-28-0x000000001BDD0000-0x000000001BDDC000-memory.dmp

          Filesize

          48KB

        • memory/3832-26-0x000000001BDB0000-0x000000001BDB8000-memory.dmp

          Filesize

          32KB

        • memory/3832-27-0x000000001BDC0000-0x000000001BDC8000-memory.dmp

          Filesize

          32KB

        • memory/3832-31-0x000000001BDF0000-0x000000001BDFC000-memory.dmp

          Filesize

          48KB

        • memory/3832-3-0x0000000002800000-0x000000000280E000-memory.dmp

          Filesize

          56KB

        • memory/3832-61-0x00007FFBF7A60000-0x00007FFBF8521000-memory.dmp

          Filesize

          10.8MB

        • memory/3832-2-0x00007FFBF7A60000-0x00007FFBF8521000-memory.dmp

          Filesize

          10.8MB

        • memory/3832-1-0x0000000000470000-0x0000000000776000-memory.dmp

          Filesize

          3.0MB