Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
31/10/2024, 03:47
Static task
static1
Behavioral task
behavioral1
Sample
bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
General
- Target bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e.exe
- Size 2.8MB
- Sample241031-ecep1azbkm
- SHA256 bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e
- MD5 d1e1ae8dced915651e8f1db114c073ea
- SHA1 ae0f6cd564fd95889eb166c54bee37567f27add4
- SHA512 e0ff5e949117808d631680a27d27483679f174a6cedcdf16f0e2c1bb479144c6c59c7754ef7eb8aa65a0562c624ed06864dc8ad9d0e2c53428bbcc0b6cd6c2ad
- SSDEEP 49152:qR5omlL3SICIhCj3q4Hdliu/syu/m4cq1Inf6ZkYU6wUd9D9+tho51N009:qR5oiiICy8HTiuPiR1If6iYUMmy51yO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- DCRat payload 2 IoCs
resource yara_rule behavioral2/files/0x000a000000023b85-54.dat family_dcrat_v2 behavioral2/memory/1804-55-0x0000000000A90000-0x0000000000B5A000-memory.dmp family_dcrat_v2 - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Installer.exe - Executes dropped EXE 8 IoCs
pid Process 1588 7z.exe 1484 7z.exe 4256 7z.exe 1444 7z.exe 1660 7z.exe 3984 7z.exe 1804 Installer.exe 3736 RuntimeBroker.exe - Loads dropped DLL 6 IoCs
pid Process 1588 7z.exe 1484 7z.exe 4256 7z.exe 1444 7z.exe 1660 7z.exe 3984 7z.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\conhost.exe Installer.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\088424020bedd6 Installer.exe File created C:\Program Files\Windows Mail\bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e.exe Installer.exe File created C:\Program Files\Windows Mail\e1ddd36cfe04f1 Installer.exe File created C:\Program Files\Microsoft Office\root\services.exe Installer.exe File created C:\Program Files\Microsoft Office\root\c5b4cb5e9653cc Installer.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Downloaded Program Files\9e8d7a4ca61bd9 Installer.exe File created C:\Windows\SystemResources\Windows.UI.Cred\dllhost.exe Installer.exe File created C:\Windows\Downloaded Program Files\RuntimeBroker.exe Installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings Installer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe 1804 Installer.exe - Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeRestorePrivilege 1588 7z.exe Token: 35 1588 7z.exe Token: SeSecurityPrivilege 1588 7z.exe Token: SeSecurityPrivilege 1588 7z.exe Token: SeRestorePrivilege 1484 7z.exe Token: 35 1484 7z.exe Token: SeSecurityPrivilege 1484 7z.exe Token: SeSecurityPrivilege 1484 7z.exe Token: SeRestorePrivilege 4256 7z.exe Token: 35 4256 7z.exe Token: SeSecurityPrivilege 4256 7z.exe Token: SeSecurityPrivilege 4256 7z.exe Token: SeRestorePrivilege 1444 7z.exe Token: 35 1444 7z.exe Token: SeSecurityPrivilege 1444 7z.exe Token: SeSecurityPrivilege 1444 7z.exe Token: SeRestorePrivilege 1660 7z.exe Token: 35 1660 7z.exe Token: SeSecurityPrivilege 1660 7z.exe Token: SeSecurityPrivilege 1660 7z.exe Token: SeRestorePrivilege 3984 7z.exe Token: 35 3984 7z.exe Token: SeSecurityPrivilege 3984 7z.exe Token: SeSecurityPrivilege 3984 7z.exe Token: SeDebugPrivilege 1804 Installer.exe Token: SeDebugPrivilege 3736 RuntimeBroker.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2064 1672 bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e.exe 87 PID 1672 wrote to memory of 2064 1672 bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e.exe 87 PID 2064 wrote to memory of 1436 2064 cmd.exe 89 PID 2064 wrote to memory of 1436 2064 cmd.exe 89 PID 2064 wrote to memory of 1588 2064 cmd.exe 90 PID 2064 wrote to memory of 1588 2064 cmd.exe 90 PID 2064 wrote to memory of 1484 2064 cmd.exe 91 PID 2064 wrote to memory of 1484 2064 cmd.exe 91 PID 2064 wrote to memory of 4256 2064 cmd.exe 92 PID 2064 wrote to memory of 4256 2064 cmd.exe 92 PID 2064 wrote to memory of 1444 2064 cmd.exe 93 PID 2064 wrote to memory of 1444 2064 cmd.exe 93 PID 2064 wrote to memory of 1660 2064 cmd.exe 94 PID 2064 wrote to memory of 1660 2064 cmd.exe 94 PID 2064 wrote to memory of 3984 2064 cmd.exe 95 PID 2064 wrote to memory of 3984 2064 cmd.exe 95 PID 2064 wrote to memory of 3264 2064 cmd.exe 96 PID 2064 wrote to memory of 3264 2064 cmd.exe 96 PID 2064 wrote to memory of 1804 2064 cmd.exe 97 PID 2064 wrote to memory of 1804 2064 cmd.exe 97 PID 1804 wrote to memory of 1616 1804 Installer.exe 100 PID 1804 wrote to memory of 1616 1804 Installer.exe 100 PID 1616 wrote to memory of 3640 1616 cmd.exe 102 PID 1616 wrote to memory of 3640 1616 cmd.exe 102 PID 1616 wrote to memory of 4828 1616 cmd.exe 103 PID 1616 wrote to memory of 4828 1616 cmd.exe 103 PID 1616 wrote to memory of 3736 1616 cmd.exe 108 PID 1616 wrote to memory of 3736 1616 cmd.exe 108 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3264 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e.exe"C:\Users\Admin\AppData\Local\Temp\bca73c47a374e5afe3a2ffbb42c1692fd096ebfe0af45ad5c5e12a9e37cd0e2e.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"2⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\system32\mode.commode 65,103⤵PID:1436
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p237578392143213652313078912 -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\system32\attrib.exeattrib +H "Installer.exe"3⤵
- Views/modifies file attributes
PID:3264
-
-
C:\Users\Admin\AppData\Local\Temp\main\Installer.exe"Installer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aLLFk8KoU9.bat"4⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:3640
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:25⤵PID:4828
-
-
C:\Windows\Downloaded Program Files\RuntimeBroker.exe"C:\Windows\Downloaded Program Files\RuntimeBroker.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\aLLFk8KoU9.bat
- Size 229B
- SHA256 8b1eb13cfe06362daf5de096b51a8eb518d4286e98c9094db12e1be635308593
- MD5 21307b7eedcb427252781252a1bb51d5
- SHA1 efd47cce8ec1382cbeb4b1e67fe7ced032908168
- SHA512 20f0b6d7b6c214414673c3b6b8f9b7f5da4b2f407a5d14226ab713ee1efc6d7070db2b97aa2622969eca28715d31d836051e7026cfb5019ebf19c0184c661c5e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
- Size 1.6MB
- SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
- MD5 72491c7b87a7c2dd350b727444f13bb4
- SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
- SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
- SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
- Size 458KB
- SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
- MD5 619f7135621b50fd1900ff24aade1524
- SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
- SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
- SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
- Size 785KB
- SHA256 45fc98c0fe74f360e57e80e42142c4d5745652c198b298ca7f8ecf4dba560c21
- MD5 acdd5f8a230ebcf456977ac3d1ea6eca
- SHA1 e0a985b5c9e99d3b1e1141938afeecdc02811946
- SHA512 5372fc4ed4ff8cb54f2139e552c7710f2ad8b4f59bc5743d02a1830a98f2c45553bf807545bf6c93952ae786bc1bd9eb480b98ddf5c924dcc0f5aef9abee2f3d
- SSDEEP 12288:Vsn10zbyXXU6ujwY2P65LpW3Ari4VVyZC0+1cKC8Rn8D6mkdo8vtbtEr67+:VeMkEwY2P6d3iE0n4j7BGr67+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
- Size 2.2MB
- SHA256 965d0ba59eb90d3b89212ab5d7d02ecd5712feb91eee7bf9e82303d872341953
- MD5 7e703968b4e13722892cf227f37b392d
- SHA1 4eba1cbed7b31cdb2ffc9ee7c200bd977af068b0
- SHA512 74099ed995ce1b92a95243cebfefbcb32e660468032d12c65437e412ebfb2d23efdf6a6ea7158e06e2574775258862307143efd9ff662b1587e97383f87e299b
- SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xA:R9kqGu7okoZscCnf0/Zs9X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
- Size 315KB
- SHA256 47b472974b1d440f6754b09fb0f053d11deb10734cb60a69d2c7bcbdb9ddd4f6
- MD5 55a752087f41b97f460d16cd084c1e5d
- SHA1 9b1379a8d2fba0322e4ca6274b609d032d703efc
- SHA512 22d00f24358854bb79dfe244e9033e14969fe1181a9adff9f4be56864af401da821b2087ef0e9c03419f097d4d21451b290bc5243a015f95844094c6bcb913e2
- SSDEEP 6144:UOdCrrNKQx2y4CBu/OdbejTWLjISiVYNDxkKGIQT7wjzfL1cxOA1e+:B8rsuVvBuIbeP08vYVaj/PK1EOwe+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
- Size 315KB
- SHA256 d521a8feb747997745848003e56981246828cc02f2534c7620442886c38d30a3
- MD5 99941e921b39fbdbbad43c87f518488a
- SHA1 6413ddd612ba05a330761c6d0ecec67e6f08b557
- SHA512 502b30672bc20713e3a0e8d28c1d649b24301f067367fd41e086deb55daf90da86665771ca0fedb07ed637deb10f789717c3377261ec96d6f6d4c4d88ce504a6
- SSDEEP 6144:qHjCdrN8Qx2ycC7Dhx/dLje5TWL3CSQVQND/kKugQT7cbNfLNYxOQ1eE:xdquVb7Tlfe50SPQVshHP4NIOgeE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
- Size 315KB
- SHA256 0285293c2c4829281fdc81ce4e1755425ed884364883008b608dca0d0421914b
- MD5 6a9bd1c18b86241e8752bd9d1a9fcdc5
- SHA1 77cc56608cc38c8e1295299af82eb661ae8b41bf
- SHA512 a1f2ed6c9e63ddfc8897b494593f8188a91b217e92509caca8f92f47184b1212bc1ec5e8885aa8f4e8076e081ff85278107101b45d476fbc3d12494082735807
- SSDEEP 6144:uHjCdrN8Qx2ycC7Dhx/dLje5TWL3CSQVQND/kKugQT7cbNfLNYxOQ1eB:ldquVb7Tlfe50SPQVshHP4NIOgeB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
- Size 316KB
- SHA256 fae5dc0c1e2965b4e1f156e27ebfae84a5a392a9c1d238c023f4635c520815e0
- MD5 45b44488f58e268aee145714065d01b1
- SHA1 57d788efaa8e83d909a2bfd54fe735925818c574
- SHA512 54c2144629f75d4e1d563270cc206ec568bf844ff66634626153797c1ea47224928301defc13823b2d79de861302e2b69b753e88b99b7c852fbb85f736cdbc9a
- SSDEEP 6144:KHjCdrN8Qx2ycC7Dhx/dLje5TWL3CSQVQND/kKugQT7cbNfLNYxOQ1ed:RdquVb7Tlfe50SPQVshHP4NIOged
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
- Size 1.9MB
- SHA256 b02e6aa68ee324b379a371f1f28960fabad6a7d3aef1bb7ca9e47e96f86ee55e
- MD5 1b7169f7136811025acefcbd57c4c3aa
- SHA1 6b0ce940277dc6573248ee817a17101d0c8e8d82
- SHA512 aed911a939ea65f2700ecb9493cb53ca2966538ff343c0145961ba5d343f1a94e136d70bac0b25cc21e6c22d51ecd6edd7177c96e751c417c317c3f967488b0b
- SSDEEP 49152:qujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oZPBHFVo7wlYh:qaR3D0Ae5mwdkDWm1XoZPxFVwwlYh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\file.bin
- Size 1.9MB
- SHA256 143aedd2b9be4342531a716d6c06e57ed02cd3e6fd0e61a5f0b810754b3d8931
- MD5 3ca63b69b8fecf3105fe03db79fe485e
- SHA1 299b02bc2ea3534300304afdc2fcdede1c50aaae
- SHA512 185f0c807b895da4a46e06f540fbca3d93a38d42d7c5667925ca012cd67852fff5d2de0aa8eb75a29ac8f069fd7d6d7349ac3d81174c2d61495eac99985c5024
- SSDEEP 49152:sI31sj6wXcXcBKBuJNJmUlK9uSIdxmCqy+hC8E0V9G5tV:t31seFXQJbmUY9uSIiC9wC8dEtV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\main\main.bat
- Size 473B
- SHA256 4a0ebfb38b6023319aee0249a2616a9153db091dcb8abb5189c165c0b3f47c3e
- MD5 888d8edcc3b71e613ea61ea10c012783
- SHA1 a5985a3a80b00287e7987262c5d452c4c5e92cfe
- SHA512 5d49219c24df5e88d66e704a9315e2015787a68f085bb6f2cf548abb96137e329ef5d551e9b2417df04392102824e0ac0e024809ed6088d8e429557a43e2b554
- MD5 SHA1 SHA512