Analysis
-
max time kernel
93s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 02:40
Behavioral task
behavioral1
Sample
79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe
Resource
win10v2004-20241007-en
General
-
Target
79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe
-
Size
1001KB
-
MD5
5313e2143d6c1f978638038f19f29e6b
-
SHA1
c70695edf05d60e4726fcdd905ff23248b7ba1dd
-
SHA256
79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526
-
SHA512
1b6293810afd89fee0b93a73a6ae73844677f98a7e1cff389637d56dbf908e2f20556765cb95d77156fd704c154f224920bec666deb23b5972b9ed0dcdb4e76b
-
SSDEEP
12288:9gSCIO3J+/FC3kveKD/FefpE/PZpaf0UPIvJ+0DELw4X7x2tTtUG4:9xCIOgFC3kveIFnPMhG3EEOAvUG4
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4488 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1992 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3900 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3408 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4156 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4308 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1848 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4080 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3836 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2676 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1384 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3896 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3592 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 976 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3752 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1288 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4032 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4688 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1952 4324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4412 4324 schtasks.exe 83 -
resource yara_rule behavioral2/memory/4716-1-0x0000000000890000-0x0000000000992000-memory.dmp dcrat behavioral2/files/0x0007000000023cb5-13.dat dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe -
Executes dropped EXE 1 IoCs
pid Process 4272 RuntimeBroker.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Windows NT\Accessories\ja-JP\9e8d7a4ca61bd9 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe File created C:\Program Files\Windows NT\Accessories\ja-JP\RuntimeBroker.exe 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\PLA\Rules\en-US\unsecapp.exe 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe File opened for modification C:\Windows\PLA\Rules\en-US\unsecapp.exe 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe File created C:\Windows\PLA\Rules\en-US\29c1c3cc0f7685 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4688 schtasks.exe 4488 schtasks.exe 1992 schtasks.exe 1848 schtasks.exe 3896 schtasks.exe 3592 schtasks.exe 4080 schtasks.exe 3836 schtasks.exe 976 schtasks.exe 1288 schtasks.exe 4032 schtasks.exe 1952 schtasks.exe 4412 schtasks.exe 3900 schtasks.exe 3408 schtasks.exe 4308 schtasks.exe 2676 schtasks.exe 1384 schtasks.exe 3016 schtasks.exe 4156 schtasks.exe 3752 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4716 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe 4716 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe 4716 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe 4716 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe 4716 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe 4272 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4716 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe Token: SeDebugPrivilege 4272 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4716 wrote to memory of 3304 4716 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe 106 PID 4716 wrote to memory of 3304 4716 79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe 106 PID 3304 wrote to memory of 948 3304 cmd.exe 108 PID 3304 wrote to memory of 948 3304 cmd.exe 108 PID 3304 wrote to memory of 4272 3304 cmd.exe 115 PID 3304 wrote to memory of 4272 3304 cmd.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe"C:\Users\Admin\AppData\Local\Temp\79dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HjQK8aO9M1.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:948
-
-
C:\Program Files\Windows NT\Accessories\ja-JP\RuntimeBroker.exe"C:\Program Files\Windows NT\Accessories\ja-JP\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\Rules\en-US\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\PLA\Rules\en-US\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\Rules\en-US\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Saved Games\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Saved Games\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\My Documents\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Default\My Documents\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Music\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\Music\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD58a4f36ffd60f5058275ade63b2b04583
SHA1743174e20e82707e1ce5ac3aac7479ea3a85acb0
SHA256fcb431bc30e2dc39f169ab59ca404ee0c8b4f6b7ac276de2da3f449f1391bd1a
SHA5124d5a40a72f6a42e415a61f6ec02c3f4597872f0bf11b2d0fb095516b8719c036c0d39cb1a315bbee53944b7517aa1c293da3cb726f9a6076ec6773f851a90dc1
-
Filesize
1001KB
MD55313e2143d6c1f978638038f19f29e6b
SHA1c70695edf05d60e4726fcdd905ff23248b7ba1dd
SHA25679dae0f514b2233117f467b8853affc5c050e71621761b5bca2a7f002c1ca526
SHA5121b6293810afd89fee0b93a73a6ae73844677f98a7e1cff389637d56dbf908e2f20556765cb95d77156fd704c154f224920bec666deb23b5972b9ed0dcdb4e76b