Analysis

  • max time kernel
    140s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 04:18

General

  • Target

    Crystal.exe

  • Size

    3.0MB

  • MD5

    d59c7cc6f109cb59fa55309f4f829692

  • SHA1

    18c2361058540fdf9684ba07cef04085d90dbaa2

  • SHA256

    a35bb31351cf385fe52b27c02642f2f99aed0d8fd472b4df12bf508faf3426d3

  • SHA512

    532d135a1009a4a4985cbf15ad1cd1fe35a2ea5bb1a8ce15da5c2f5f6d7cb9b07491715b24539ad36702c664fb71e98a4f3aca1753691de5a02d73caa87bbc00

  • SSDEEP

    49152:KDaBkTKFi1vosNsqTGmCOicY/TCJyMRrCUXVgGdCMKxdaFVOJjg5BRifqGkuPSXv:GaBEvo1qTga4AJTldCZmcUTRwkv1rlxB

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Crystal.exe
    "C:\Users\Admin\AppData\Local\Temp\Crystal.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1620-0-0x00000000011C0000-0x0000000001958000-memory.dmp

    Filesize

    7.6MB

  • memory/1620-1-0x00000000760F4000-0x00000000760F5000-memory.dmp

    Filesize

    4KB

  • memory/1620-2-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-14-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-13-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-19-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-21-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-31-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-29-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-28-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-27-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-26-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-22-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-20-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-18-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-17-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-16-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-15-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-12-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-11-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-10-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-9-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-8-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-7-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-6-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-5-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-4-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-3-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-32-0x00000000011C0000-0x0000000001958000-memory.dmp

    Filesize

    7.6MB

  • memory/1620-33-0x00000000011C0000-0x0000000001958000-memory.dmp

    Filesize

    7.6MB

  • memory/1620-34-0x00000000011C0000-0x0000000001958000-memory.dmp

    Filesize

    7.6MB

  • memory/1620-35-0x00000000760F4000-0x00000000760F5000-memory.dmp

    Filesize

    4KB

  • memory/1620-36-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB

  • memory/1620-37-0x00000000760E0000-0x00000000761F0000-memory.dmp

    Filesize

    1.1MB