Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-11-2024 07:41
Static task
static1
Behavioral task
behavioral1
Sample
1d13a84aa671b75f66f4c7fce8339619291d4a43.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
1d13a84aa671b75f66f4c7fce8339619291d4a43.exe
Resource
win10v2004-20241007-en
General
-
Target
1d13a84aa671b75f66f4c7fce8339619291d4a43.exe
-
Size
775KB
-
MD5
0ed1f9cb842483e03e36cee538678ffd
-
SHA1
1d13a84aa671b75f66f4c7fce8339619291d4a43
-
SHA256
24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc
-
SHA512
78cb214db0ecbc532a50fc1344a138125e0031485c004e95bc21064165f9fd667fa582cd5196a6e1b4276b6dd7fa1d23dfabfe0c58b0d93fbf8e5329b064a809
-
SSDEEP
12288:FFg6HIZxWaga+z9e9qJeyLVqlUhqgPXdU2ypi0w8ncqXuvVw4heSNSzLz/:FIrr+h0qJeiqlGVUskcz9w4jI3b
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Processes:
resource yara_rule behavioral2/memory/1672-12-0x0000000000400000-0x0000000000478000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1d13a84aa671b75f66f4c7fce8339619291d4a43.exe1d13a84aa671b75f66f4c7fce8339619291d4a43.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe -
Executes dropped EXE 1 IoCs
Processes:
OfficeClickToRun.exepid Process 3672 OfficeClickToRun.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1d13a84aa671b75f66f4c7fce8339619291d4a43.exedescription pid Process procid_target PID 1680 set thread context of 1672 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 96 -
Drops file in Program Files directory 4 IoCs
Processes:
1d13a84aa671b75f66f4c7fce8339619291d4a43.exedescription ioc Process File created C:\Program Files\Windows Mail\fontdrvhost.exe 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe File created C:\Program Files\Windows Mail\5b884080fd4f94e2695da25c503f9e33b9605b83 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0\OfficeClickToRun.exe 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0\e6c9b481da804f07baff8eff543b0a1441069b5d 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe -
Drops file in Windows directory 5 IoCs
Processes:
1d13a84aa671b75f66f4c7fce8339619291d4a43.exedescription ioc Process File created C:\Windows\ja-JP\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI\StartMenuExperienceHost.exe 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI\55b276f4edf653fe07efe8f1ecc32d3d195abd16 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe File created C:\Windows\ja-JP\services.exe 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe File opened for modification C:\Windows\ja-JP\services.exe 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
schtasks.execmd.exePING.EXEOfficeClickToRun.exe1d13a84aa671b75f66f4c7fce8339619291d4a43.exepowershell.exeschtasks.exeschtasks.exechcp.com1d13a84aa671b75f66f4c7fce8339619291d4a43.exeschtasks.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies registry class 1 IoCs
Processes:
1d13a84aa671b75f66f4c7fce8339619291d4a43.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid Process 4052 schtasks.exe 4004 schtasks.exe 3012 schtasks.exe 3276 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exe1d13a84aa671b75f66f4c7fce8339619291d4a43.exepid Process 2552 powershell.exe 2552 powershell.exe 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe1d13a84aa671b75f66f4c7fce8339619291d4a43.exedescription pid Process Token: SeDebugPrivilege 2552 powershell.exe Token: SeDebugPrivilege 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
1d13a84aa671b75f66f4c7fce8339619291d4a43.exe1d13a84aa671b75f66f4c7fce8339619291d4a43.execmd.exedescription pid Process procid_target PID 1680 wrote to memory of 2552 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 95 PID 1680 wrote to memory of 2552 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 95 PID 1680 wrote to memory of 2552 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 95 PID 1680 wrote to memory of 1672 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 96 PID 1680 wrote to memory of 1672 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 96 PID 1680 wrote to memory of 1672 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 96 PID 1680 wrote to memory of 1672 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 96 PID 1680 wrote to memory of 1672 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 96 PID 1680 wrote to memory of 1672 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 96 PID 1680 wrote to memory of 1672 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 96 PID 1680 wrote to memory of 1672 1680 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 96 PID 1672 wrote to memory of 4052 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 99 PID 1672 wrote to memory of 4052 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 99 PID 1672 wrote to memory of 4052 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 99 PID 1672 wrote to memory of 4004 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 101 PID 1672 wrote to memory of 4004 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 101 PID 1672 wrote to memory of 4004 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 101 PID 1672 wrote to memory of 3012 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 103 PID 1672 wrote to memory of 3012 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 103 PID 1672 wrote to memory of 3012 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 103 PID 1672 wrote to memory of 3276 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 105 PID 1672 wrote to memory of 3276 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 105 PID 1672 wrote to memory of 3276 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 105 PID 1672 wrote to memory of 4532 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 107 PID 1672 wrote to memory of 4532 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 107 PID 1672 wrote to memory of 4532 1672 1d13a84aa671b75f66f4c7fce8339619291d4a43.exe 107 PID 4532 wrote to memory of 1492 4532 cmd.exe 109 PID 4532 wrote to memory of 1492 4532 cmd.exe 109 PID 4532 wrote to memory of 1492 4532 cmd.exe 109 PID 4532 wrote to memory of 3228 4532 cmd.exe 110 PID 4532 wrote to memory of 3228 4532 cmd.exe 110 PID 4532 wrote to memory of 3228 4532 cmd.exe 110 PID 4532 wrote to memory of 3672 4532 cmd.exe 111 PID 4532 wrote to memory of 3672 4532 cmd.exe 111 PID 4532 wrote to memory of 3672 4532 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d13a84aa671b75f66f4c7fce8339619291d4a43.exe"C:\Users\Admin\AppData\Local\Temp\1d13a84aa671b75f66f4c7fce8339619291d4a43.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1d13a84aa671b75f66f4c7fce8339619291d4a43.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Users\Admin\AppData\Local\Temp\1d13a84aa671b75f66f4c7fce8339619291d4a43.exe"C:\Users\Admin\AppData\Local\Temp\1d13a84aa671b75f66f4c7fce8339619291d4a43.exe"2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\Windows\ja-JP\services.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4052
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI\StartMenuExperienceHost.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4004
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3012
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0\OfficeClickToRun.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3276
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gvm46Oxs3i.bat"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
PID:1492
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3228
-
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0\OfficeClickToRun.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0\OfficeClickToRun.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3672
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0\OfficeClickToRun.exe
Filesize775KB
MD50ed1f9cb842483e03e36cee538678ffd
SHA11d13a84aa671b75f66f4c7fce8339619291d4a43
SHA25624f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc
SHA51278cb214db0ecbc532a50fc1344a138125e0031485c004e95bc21064165f9fd667fa582cd5196a6e1b4276b6dd7fa1d23dfabfe0c58b0d93fbf8e5329b064a809
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1d13a84aa671b75f66f4c7fce8339619291d4a43.exe.log
Filesize1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
Filesize
272B
MD597310bc77ffc46731fb8043857ac92d3
SHA1bd809c689007c93d3eab7a635c6ee575ac9f4f53
SHA256e99fc2ba7b63aacc53e122a3854434edb49721f7ae3474796b93b0858240c651
SHA5125380713c8f26395e7a1c0ed3e8e60077e9704aebb7abc522eedcde831fa82e389e419ab0e71343614c673312654cebcd1d6d5fc67d73822c4382cc26f5c2caf6
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82