Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    03-11-2024 09:52

General

  • Target

    004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe

  • Size

    952KB

  • MD5

    b86ee30e813ada623950e69411e39f20

  • SHA1

    8027da1ceaf274b125b2499404f44933ce8c1cf3

  • SHA256

    004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766cee

  • SHA512

    c9d16edd860b01f893ee47dd65dea0ee3779015b4039a0fdf05a6567dd5ecdb87ec8012a8306e0237a0675a27e9b3db6553a10fb941336f26fd468fa85ef5fd9

  • SSDEEP

    24576:2+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:R8/KfRTK

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 9 IoCs
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 18 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in System32 directory 15 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe
    "C:\Users\Admin\AppData\Local\Temp\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2128
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Xg4aZZWmiX.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:112
        • C:\Documents and Settings\audiodg.exe
          "C:\Documents and Settings\audiodg.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:1452
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Documents and Settings\audiodg.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2684
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\dispex\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2672
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\de-DE\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2488
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Documents and Settings\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2708
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2700
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1168
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766ceeN.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1888
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\RestartManagerUninstall\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:884
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\ipsecsnp\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2584

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Xg4aZZWmiX.bat

      Filesize

      201B

      MD5

      b7fe229944cfe750f720d6b31c06219c

      SHA1

      0c285b0904b838e8078c2008d31ab9eee4d816cb

      SHA256

      c2349a7b2520eb1dc9c66a661c41547dd6e1736774dc19fb7b35016bf0b60090

      SHA512

      97e46ba04c36d21b61c13d56914d2d9b0ca39e9eb40b7e3a104677f636454f86d4d7919c00a067f9950a3a2a3ca78556558002f005db34898546f2e8543d8bc7

    • C:\Users\Default\taskhost.exe

      Filesize

      952KB

      MD5

      b86ee30e813ada623950e69411e39f20

      SHA1

      8027da1ceaf274b125b2499404f44933ce8c1cf3

      SHA256

      004e2051dde231741f7be44ccc11a2ac05170785f1c2b702e8ae3ee8b3766cee

      SHA512

      c9d16edd860b01f893ee47dd65dea0ee3779015b4039a0fdf05a6567dd5ecdb87ec8012a8306e0237a0675a27e9b3db6553a10fb941336f26fd468fa85ef5fd9

    • memory/1452-150-0x0000000000A40000-0x0000000000B34000-memory.dmp

      Filesize

      976KB

    • memory/2128-4-0x0000000000360000-0x0000000000370000-memory.dmp

      Filesize

      64KB

    • memory/2128-0-0x000007FEF5EB3000-0x000007FEF5EB4000-memory.dmp

      Filesize

      4KB

    • memory/2128-6-0x0000000000370000-0x000000000037C000-memory.dmp

      Filesize

      48KB

    • memory/2128-5-0x0000000000420000-0x000000000042A000-memory.dmp

      Filesize

      40KB

    • memory/2128-7-0x0000000000470000-0x000000000047A000-memory.dmp

      Filesize

      40KB

    • memory/2128-8-0x0000000000450000-0x0000000000458000-memory.dmp

      Filesize

      32KB

    • memory/2128-10-0x0000000000600000-0x000000000060C000-memory.dmp

      Filesize

      48KB

    • memory/2128-9-0x0000000000390000-0x000000000039A000-memory.dmp

      Filesize

      40KB

    • memory/2128-11-0x0000000000380000-0x000000000038C000-memory.dmp

      Filesize

      48KB

    • memory/2128-3-0x0000000000350000-0x0000000000360000-memory.dmp

      Filesize

      64KB

    • memory/2128-2-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

      Filesize

      9.9MB

    • memory/2128-147-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

      Filesize

      9.9MB

    • memory/2128-1-0x0000000001320000-0x0000000001414000-memory.dmp

      Filesize

      976KB