Overview

overview

10

Static

static

1

D1DAC6E0CF...4D.exe

windows7-x64

10

D1DAC6E0CF...4D.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2024, 19:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    D1DAC6E0CF79A43434F1AC4C84B9EF4D.exe

  • Size

    1.2MB

  • MD5

    d1dac6e0cf79a43434f1ac4c84b9ef4d

  • SHA1

    35a0db7e5548b32fa4a44eb897beb9fbbdcc7962

  • SHA256

    9b0117b8c8455a1eaadc91283f7910ee263e2398893b1c288c64d8a500c388dd

  • SHA512

    43c1df1b5ea8d477977577e5a2a683e0c6621db649709a1447c783540e2e019053d288898fc255c2c27dedc20df595176a3b5a70c58a6a994f9b83192cc8989f

  • SSDEEP

    24576:9sayvYwy9cCAiDSeqgpkcqK0QrmU9cPVbGI61T7Kamt:WayQfSeXqK5Z9gsI6dud

Score
10/10
dcratdiscoveryinfostealerratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\D1DAC6E0CF79A43434F1AC4C84B9EF4D.exe
    "C:\Users\Admin\AppData\Local\Temp\D1DAC6E0CF79A43434F1AC4C84B9EF4D.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Users\Admin\AppData\Local\Temp\D1DAC6E0CF79A43434F1AC4C84B9EF4D.exe
      "C:\Users\Admin\AppData\Local\Temp\D1DAC6E0CF79A43434F1AC4C84B9EF4D.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Users\Admin\AppData\Roaming\fSvRaR9z4d.exe
        "C:\Users\Admin\AppData\Roaming\fSvRaR9z4d.exe"
        3⤵
        • Executes dropped EXE
        PID:3172
      • C:\Users\Admin\AppData\Roaming\eitGLNiXcz.exe
        "C:\Users\Admin\AppData\Roaming\eitGLNiXcz.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3620
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rGhUXuzGmB.bat"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3680
          • C:\Windows\system32\w32tm.exe
            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            5⤵
              PID:2880
            • C:\Recovery\WindowsRE\RuntimeBroker.exe
              "C:\Recovery\WindowsRE\RuntimeBroker.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 268
        2⤵
        • Program crash
        PID:5104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4960 -ip 4960
      1⤵
        PID:1232
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\lsass.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3480
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\lsass.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4436
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\lsass.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3580
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4412
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4932
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:972
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "eitGLNiXcze" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft\WDF\eitGLNiXcz.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1360
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "eitGLNiXcz" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\WDF\eitGLNiXcz.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1116
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "eitGLNiXcze" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft\WDF\eitGLNiXcz.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1108

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\rGhUXuzGmB.bat
        Filesize

        204B

        MD5

        bce44f68205d5e61e273205a6377afec

        SHA1

        758b4696bc3c69410339a0d1f212341d4b454be5

        SHA256

        5302b012cba014b9197469afa14c9ca46259625e204ff256a3d7910787e1eee3

        SHA512

        31f797f86569fed79d09a1a1ae1aa361bcaa14df6f4ccd9e95ef6bc456b1a9ccebfba4789ae698be721c40d45bc88c01f4118b35f07e93baf8f7da3e0bca4aa4

        Download Submit

      • C:\Users\Admin\AppData\Roaming\eitGLNiXcz.exe
        Filesize

        716KB

        MD5

        2ea728129d813b8a99509cc009968d2e

        SHA1

        4705bf7c666dceb4db384cb487d796557583d107

        SHA256

        384773df6081637cd1d36872cace14b1df5e5d59cb9bed47512b0618185ca8fd

        SHA512

        9a67df09a331602e6a9176bbc6277cf7908085e768b9da2e13f6ba99934020d46823073d8e19b6cb2dd19ee0c75407a67c5095fb33068679a7ab5d760764db39

        Download Submit

      • C:\Users\Admin\AppData\Roaming\fSvRaR9z4d.exe
        Filesize

        18KB

        MD5

        f3edff85de5fd002692d54a04bcb1c09

        SHA1

        4c844c5b0ee7cb230c9c28290d079143e00cb216

        SHA256

        caf29650446db3842e1c1e8e5e1bafadaf90fc82c5c37b9e2c75a089b7476131

        SHA512

        531d920e2567f58e8169afc786637c1a0f7b9b5c27b27b5f0eddbfc3e00cecd7bea597e34061d836647c5f8c7757f2fe02952a9793344e21b39ddd4bf7985f9d

        Download Submit

      • memory/1428-27-0x0000000000400000-0x00000000004F0000-memory.dmp

        Filesize

        960KB

        Download

      • memory/1428-1-0x0000000000400000-0x00000000004F0000-memory.dmp

        Filesize

        960KB

        Download

      • memory/1428-4-0x0000000000400000-0x00000000004F0000-memory.dmp

        Filesize

        960KB

        Download

      • memory/1428-5-0x00000000005B0000-0x00000000006DB000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/1428-2-0x0000000000400000-0x00000000004F0000-memory.dmp

        Filesize

        960KB

        Download

      • memory/1428-3-0x0000000000400000-0x00000000004F0000-memory.dmp

        Filesize

        960KB

        Download

      • memory/3620-30-0x00007FFD55963000-0x00007FFD55965000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3620-31-0x0000000000800000-0x00000000008BA000-memory.dmp

        Filesize

        744KB

        Download

      • memory/3620-32-0x00007FFD55960000-0x00007FFD56421000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3620-33-0x0000000002AE0000-0x0000000002AFC000-memory.dmp

        Filesize

        112KB

        Download

      • memory/3620-36-0x0000000002B00000-0x0000000002B10000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3620-35-0x0000000002B20000-0x0000000002B36000-memory.dmp

        Filesize

        88KB

        Download

      • memory/3620-34-0x000000001B540000-0x000000001B590000-memory.dmp

        Filesize

        320KB

        Download

      • memory/3620-48-0x00007FFD55960000-0x00007FFD56421000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4960-0-0x00000000006D3000-0x00000000006D5000-memory.dmp

        Filesize

        8KB

        Download