Overview
overview
10Static
static
10-pril-main...th.exe
windows7-x64
10-pril-main...th.exe
windows10-2004-x64
10-pril-main...aw.exe
windows7-x64
10-pril-main...aw.exe
windows10-2004-x64
10-pril-main...wd.exe
windows7-x64
7-pril-main...wd.exe
windows10-2004-x64
7-pril-main...gh.exe
windows7-x64
10-pril-main...gh.exe
windows10-2004-x64
10-pril-main...se.exe
windows7-x64
10-pril-main...se.exe
windows10-2004-x64
10-pril-main...ed.exe
windows7-x64
10-pril-main...ed.exe
windows10-2004-x64
10Installer/Accord.dll
windows7-x64
1Installer/Accord.dll
windows10-2004-x64
1Installer/CapCut.exe
windows7-x64
8Installer/CapCut.exe
windows10-2004-x64
10Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 08:13
Static task
static1
Behavioral task
behavioral1
Sample
-pril-main/dwthjadth.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
-pril-main/dwthjadth.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
-pril-main/feuiyjjdaw.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
-pril-main/feuiyjjdaw.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
-pril-main/kldrgawdtjawd.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
-pril-main/kldrgawdtjawd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
-pril-main/pothjadwtrgh.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
-pril-main/pothjadwtrgh.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
-pril-main/ptjjsekfthse.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
-pril-main/ptjjsekfthse.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
-pril-main/thadkythjawed.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
-pril-main/thadkythjawed.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Installer/Accord.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Installer/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Installer/CapCut.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Installer/CapCut.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity full v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity full v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity micro v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity micro v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity subset v3.5/Accord.dll
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity subset v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity web v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity web v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Installer/Tools/Accord.3.8.0/lib/net35/Accord.dll
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
Installer/Tools/Accord.3.8.0/lib/net35/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Installer/Tools/Accord.3.8.0/lib/net40/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Installer/Tools/Accord.3.8.0/lib/net40/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Installer/Tools/Accord.3.8.0/lib/net45/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Installer/Tools/Accord.3.8.0/lib/net45/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Installer/Tools/Accord.3.8.0/lib/net46/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Installer/Tools/Accord.3.8.0/lib/net46/Accord.dll
Resource
win10v2004-20241007-en
General
-
Target
-pril-main/ptjjsekfthse.exe
-
Size
631KB
-
MD5
4d95ea8721d0a84b69c2d60951a8a65e
-
SHA1
b3b9230b284c32e8d35c65b6b31d0a1b729c6d7c
-
SHA256
1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d
-
SHA512
7500b73aa452a6452fd6fe41df0fbffa96821918df34fcff2a29bf2072f5fdb02886fa0945f5d567fefcf30de6d042b4e17e6760bb5e5a3ceba11767316c3fee
-
SSDEEP
12288:Cr2N7ewZcHjHkoP19jpVgUbdxGU2NjCa8UQGqIJ7uHXNI8W2Zx:Cr2EEypVg4x8NmtjS+
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ptjjsekfthse.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/\\smss.exe\"" ptjjsekfthse.exe -
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3044 2820 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2052 2820 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2864 2820 schtasks.exe -
Processes:
resource yara_rule behavioral9/memory/2744-1-0x00000000010C0000-0x0000000001164000-memory.dmp dcrat C:\Users\Admin\AppData\Local\smss.exe dcrat behavioral9/memory/2828-14-0x00000000002F0000-0x0000000000394000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
smss.exepid process 2828 smss.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ptjjsekfthse.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:/Users/Admin/AppData/Local/\\smss.exe\"" ptjjsekfthse.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:/Users/Admin/AppData/Local/\\smss.exe\"" ptjjsekfthse.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2052 schtasks.exe 2864 schtasks.exe 3044 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
ptjjsekfthse.exesmss.exepid process 2744 ptjjsekfthse.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe 2828 smss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
smss.exepid process 2828 smss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ptjjsekfthse.exesmss.exedescription pid process Token: SeDebugPrivilege 2744 ptjjsekfthse.exe Token: SeDebugPrivilege 2828 smss.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ptjjsekfthse.exedescription pid process target process PID 2744 wrote to memory of 2828 2744 ptjjsekfthse.exe smss.exe PID 2744 wrote to memory of 2828 2744 ptjjsekfthse.exe smss.exe PID 2744 wrote to memory of 2828 2744 ptjjsekfthse.exe smss.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\-pril-main\ptjjsekfthse.exe"C:\Users\Admin\AppData\Local\Temp\-pril-main\ptjjsekfthse.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\smss.exe"C:\Users\Admin\AppData\Local\smss.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:/Users/Admin/AppData/Local/\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:/Users/Admin/AppData/Local/\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
631KB
MD54d95ea8721d0a84b69c2d60951a8a65e
SHA1b3b9230b284c32e8d35c65b6b31d0a1b729c6d7c
SHA2561aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d
SHA5127500b73aa452a6452fd6fe41df0fbffa96821918df34fcff2a29bf2072f5fdb02886fa0945f5d567fefcf30de6d042b4e17e6760bb5e5a3ceba11767316c3fee