Overview

overview

10

Static

static

10

1aeaabc57a...6d.exe

windows7-x64

10

1aeaabc57a...6d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 02:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d.exe

  • Size

    631KB

  • MD5

    4d95ea8721d0a84b69c2d60951a8a65e

  • SHA1

    b3b9230b284c32e8d35c65b6b31d0a1b729c6d7c

  • SHA256

    1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d

  • SHA512

    7500b73aa452a6452fd6fe41df0fbffa96821918df34fcff2a29bf2072f5fdb02886fa0945f5d567fefcf30de6d042b4e17e6760bb5e5a3ceba11767316c3fee

  • SSDEEP

    12288:Cr2N7ewZcHjHkoP19jpVgUbdxGU2NjCa8UQGqIJ7uHXNI8W2Zx:Cr2EEypVg4x8NmtjS+

Score
10/10
dcratinfostealerpersistenceratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d.exe
    "C:\Users\Admin\AppData\Local\Temp\1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d.exe
      "C:\Users\Admin\AppData\Local\Temp\1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\agxw84U7hF.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          4⤵
            PID:3500
          • C:\Users\Admin\AppData\Local\sppsvc.exe
            "C:/Users/Admin/AppData/Local/\sppsvc.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:4564
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:/Users/Admin/AppData/Local/\SppExtComObj.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4812
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\SppExtComObj.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4584
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:/Users/Admin/AppData/Local/\SppExtComObj.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3632
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:/Users/Admin/AppData/Local/\sppsvc.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3460
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2656
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:/Users/Admin/AppData/Local/\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1892

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d.exe.log
      Filesize

      1KB

      MD5

      7800fca2323a4130444c572374a030f4

      SHA1

      40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

      SHA256

      29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

      SHA512

      c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\agxw84U7hF.bat
      Filesize

      205B

      MD5

      7b475d76db5395fd5fc9ee4f0665406d

      SHA1

      367115a5cfa9a49be7f3f6d5d8e1084ac9a00a95

      SHA256

      d0ba1d60191e530300576e1fc2888dd5cd3ed74d05d26b2755169a2eaa2102a7

      SHA512

      0244ae1c9d509ff28a30c7a3599f87a676581f6be45df11b065057b88cc4ab99acb174af2f342ca91af538dd330aa29c9b76f67282c0f150a05a1154d12cd709

      Download Submit

    • C:\Users\Admin\AppData\Local\sppsvc.exe
      Filesize

      631KB

      MD5

      4d95ea8721d0a84b69c2d60951a8a65e

      SHA1

      b3b9230b284c32e8d35c65b6b31d0a1b729c6d7c

      SHA256

      1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d

      SHA512

      7500b73aa452a6452fd6fe41df0fbffa96821918df34fcff2a29bf2072f5fdb02886fa0945f5d567fefcf30de6d042b4e17e6760bb5e5a3ceba11767316c3fee

      Download Submit

    • memory/1320-0-0x00007FFE394C3000-0x00007FFE394C5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1320-1-0x0000000000970000-0x0000000000A14000-memory.dmp

      Filesize

      656KB

      Download

    • memory/1320-2-0x00007FFE394C0000-0x00007FFE39F81000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1320-4-0x000000001B580000-0x000000001B5D0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/1320-3-0x0000000002B30000-0x0000000002B4C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/1320-5-0x000000001B530000-0x000000001B546000-memory.dmp

      Filesize

      88KB

      Download

    • memory/1320-10-0x00007FFE394C0000-0x00007FFE39F81000-memory.dmp

      Filesize

      10.8MB

      Download