Overview

overview

10

Static

static

3

EC4891EC2E...15.exe

windows7-x64

10

EC4891EC2E...15.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 13:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    EC4891EC2E1E54B6E32D1E1B3BDB5915.exe

  • Size

    1.8MB

  • MD5

    ec4891ec2e1e54b6e32d1e1b3bdb5915

  • SHA1

    c30c1fad6115013e814e288a1d06d2523aec6d95

  • SHA256

    44a641d0d8a75103154273f34f65999770498af9f63aa8d878f4532718860ea6

  • SHA512

    3ab4c039d3cf22c55dedf8506851ec3ea221849eb4e132928eb314c67c38a650b403afc4270874c2d2c46875f1a9ec668b83f7619793ef75758bc2398b4cc7cc

  • SSDEEP

    24576:juhBQp12QFQP7U9QlUrNGWsm5wtgeZBN+HE3r13P+doHExf27vH/h6kcWqnxqlM:jMWYoQlUr4M4geZ2ktP+dCEeghxql

Score
10/10
dcratdiscoveryexecutioninfostealerratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EC4891EC2E1E54B6E32D1E1B3BDB5915.exe
    "C:\Users\Admin\AppData\Local\Temp\EC4891EC2E1E54B6E32D1E1B3BDB5915.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2304
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3900
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:5112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:5020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3560
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:1476
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2432
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\System.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\INT\TextInputHost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4208
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\System.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4636
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\dllhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:1812
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\SppExtComObj.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:1616
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\EC4891EC2E1E54B6E32D1E1B3BDB5915.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3504
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ci854MCMWJ.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:5608
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:5976
        • C:\Windows\IdentityCRL\INT\TextInputHost.exe
          "C:\Windows\IdentityCRL\INT\TextInputHost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:6020

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Windows Media Player\System.exe
      Filesize

      1.8MB

      MD5

      ec4891ec2e1e54b6e32d1e1b3bdb5915

      SHA1

      c30c1fad6115013e814e288a1d06d2523aec6d95

      SHA256

      44a641d0d8a75103154273f34f65999770498af9f63aa8d878f4532718860ea6

      SHA512

      3ab4c039d3cf22c55dedf8506851ec3ea221849eb4e132928eb314c67c38a650b403afc4270874c2d2c46875f1a9ec668b83f7619793ef75758bc2398b4cc7cc

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      77d622bb1a5b250869a3238b9bc1402b

      SHA1

      d47f4003c2554b9dfc4c16f22460b331886b191b

      SHA256

      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

      SHA512

      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      3a6bad9528f8e23fb5c77fbd81fa28e8

      SHA1

      f127317c3bc6407f536c0f0600dcbcf1aabfba36

      SHA256

      986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

      SHA512

      846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      bd5940f08d0be56e65e5f2aaf47c538e

      SHA1

      d7e31b87866e5e383ab5499da64aba50f03e8443

      SHA256

      2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

      SHA512

      c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      a8e8360d573a4ff072dcc6f09d992c88

      SHA1

      3446774433ceaf0b400073914facab11b98b6807

      SHA256

      bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

      SHA512

      4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      293a5e452e148112857e22e746feff34

      SHA1

      7a5018bf98a3e38970809531288a7e3efb979532

      SHA256

      05e48657fb5340817f522c955b379cfb639977480af3ab1414682e9bf6616551

      SHA512

      7332f2b22f4ab64bb67c1a493f7cf2b378e311d5be6c6c99339210d4e9022c17f01a698333cd679a0776cca23460e28ec88c2ccfcf50c732ee218ef25ab19049

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      61e06aa7c42c7b2a752516bcbb242cc1

      SHA1

      02c54f8b171ef48cad21819c20b360448418a068

      SHA256

      5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

      SHA512

      03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      28d4235aa2e6d782751f980ceb6e5021

      SHA1

      f5d82d56acd642b9fc4b963f684fd6b78f25a140

      SHA256

      8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

      SHA512

      dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Ci854MCMWJ.bat
      Filesize

      172B

      MD5

      ed6c904d0d0e002e77e6e6cfd54e0ec7

      SHA1

      35b9768e6ea3c5b73557a6e7fa2b5785bd0ecf6d

      SHA256

      5d825622beda0ff51fe609662896389a71db94d82f1539ca197d4fcb5c41c4f6

      SHA512

      1954effced27ce46b570bbffbef5c19fa51f5204f871795f8fedfb011fe08ddb1af4f2427000a89465104ca0153f1abf5658764516e82c7139b2868407ffc784

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z5sbp02o.2uk.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/2304-38-0x000001E7949C0000-0x000001E7949E2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3612-10-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-14-0x000000001B5B0000-0x000000001B5BC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/3612-28-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-32-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-34-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-36-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-37-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-15-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-9-0x000000001B750000-0x000000001B7A0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/3612-17-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-12-0x000000001B700000-0x000000001B718000-memory.dmp

      Filesize

      96KB

      Download

    • memory/3612-0-0x00007FFBFD203000-0x00007FFBFD205000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3612-8-0x000000001B6E0000-0x000000001B6FC000-memory.dmp

      Filesize

      112KB

      Download

    • memory/3612-6-0x000000001B5A0000-0x000000001B5AE000-memory.dmp

      Filesize

      56KB

      Download

    • memory/3612-4-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-3-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-2-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3612-1-0x00000000007E0000-0x00000000009BA000-memory.dmp

      Filesize

      1.9MB

      Download