Overview

overview

10

Static

static

10

test.exe

windows10-2004-x64

test.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    106s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05-11-2024 21:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test.exe

  • Size

    1.1MB

  • MD5

    4a00e42d19f9bae651f70e79cd5ef162

  • SHA1

    b196db8fc96765b65f9da36f7c55664e9c756bb9

  • SHA256

    de577ab25710e06a94efa8f9b0b2f425377cb8df68c5068ce65204ee5b28a067

  • SHA512

    69735af42d4d44ff7814beacee6a0b80a841f44f09962a5d42ab9fdac673971fcd10e76de53b25ce19693fe6826e557fc8fe4721b3611ac22efbfa76f7405055

  • SSDEEP

    24576:u2G/nvxW3WieCs/p/1uLbrQZVK8qBlKSUd:ubA3j7TQL3Ane

Score
10/10
dcratcredential_accessdiscoveryinfostealerratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test.exe
    "C:\Users\Admin\AppData\Local\Temp\test.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\FontreviewwincommonSvc\JucJWzXGoLiqIkOEBNnKfvrb0.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\FontreviewwincommonSvc\Y0CpU.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:444
        • C:\FontreviewwincommonSvc\Bridgesurrogate.exe
          "C:\FontreviewwincommonSvc\Bridgesurrogate.exe"
          4⤵
          • Deletes itself
          • Executes dropped EXE
          • Drops autorun.inf file
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\FontreviewwincommonSvc\Bridgesurrogate.exe
    Filesize

    829KB

    MD5

    925278f34e704b81d9a837d26a72657b

    SHA1

    404bb676c8298adc01e660ba763fbf6ec08137e8

    SHA256

    2a26a9cf56694281786fb8e35863ac7a5f607301bbb72eef7e06e95c7e23f50d

    SHA512

    608a6d3456e194d918992817d2c57d97ea1758b251d4e1f4e4b9ecc375e2de6d08de2a6495ebcb7ba825eb172e862119b222006733381e1ce246e251dfd55fd7

    Download Submit

  • C:\FontreviewwincommonSvc\JucJWzXGoLiqIkOEBNnKfvrb0.vbe
    Filesize

    204B

    MD5

    0eab06ef6873fb013c9f2babf77657cb

    SHA1

    d0a76df0228e4ce0d5d4a013f54610ebb39d3a90

    SHA256

    641cb6fb5f209f0782ed6ce495fec7fbc2a4dad802e0d86ea2539f9e7280c1f1

    SHA512

    b596159b85d0e147eb845bd9a6a26ae58391845100200aeacaa658eb239183fa18589319fe8644a87eac740aaed0ba79861309bc54f5498bdbb9d31520b432fe

    Download Submit

  • C:\FontreviewwincommonSvc\Y0CpU.bat
    Filesize

    47B

    MD5

    7847aa1435648c93f0af222aa269b12b

    SHA1

    445fdd35740aada074adc4596e0cde2449865b60

    SHA256

    70a6c507c444bb21691fed477053006d8ab4e490aaa514de83b46193989816ef

    SHA512

    3c1b9d9b7f1b2f48bbca67e7175411d6b02dab55b523e357ca4b47500cc64e3481ffcb2b9c1e3ca3275f9e3673625043d0ba20ee1c82d4935a75d226b800c95d

    Download Submit

  • memory/2852-12-0x00007FF9F68C3000-0x00007FF9F68C5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2852-13-0x00000000004D0000-0x00000000005A6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/2852-16-0x000000001B3B0000-0x000000001B3BD000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2852-15-0x000000001B230000-0x000000001B239000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2852-14-0x000000001C030000-0x000000001C076000-memory.dmp

    Filesize

    280KB

    Download

  • memory/2852-19-0x00007FF9F68C3000-0x00007FF9F68C5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2852-18-0x000000001B3C0000-0x000000001B3CB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2852-17-0x000000001C080000-0x000000001C09E000-memory.dmp

    Filesize

    120KB

    Download