Analysis
-
max time kernel
91s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 12:26
Behavioral task
behavioral1
Sample
5216ca61384f1d0eaa9b873e0b756f0b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5216ca61384f1d0eaa9b873e0b756f0b.exe
Resource
win10v2004-20241007-en
General
-
Target
5216ca61384f1d0eaa9b873e0b756f0b.exe
-
Size
1.1MB
-
MD5
5216ca61384f1d0eaa9b873e0b756f0b
-
SHA1
c29692709f869ebc5743f561c8f3975b2a2d5ae9
-
SHA256
87a4b8833cd4cb394e3b19b1672491575466fe8b0afb935b7d9363a1cbaca59d
-
SHA512
8dce4092b5a9c10309228a55f0a9a6d3508eae2f1f8bf26e2196f4426398d35d2618cc001d5665be5b24cfb138c46153c74b3b56e37d26e8ec7b8c0ebbd11758
-
SSDEEP
24576:U2G/nvxW3Ww0t7EJyn5ySinOYEI09IlOmLdRz4:UbA307EJ3tEI06Rs
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3696 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 208 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2868 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1456 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4892 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4904 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4336 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4852 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3952 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3508 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1980 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3972 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 224 1436 schtasks.exe 94 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4288 1436 schtasks.exe 94 -
resource yara_rule behavioral2/files/0x000a000000023b78-10.dat dcrat behavioral2/memory/1252-13-0x0000000000F20000-0x0000000000FF6000-memory.dmp dcrat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation MsWebfont.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 5216ca61384f1d0eaa9b873e0b756f0b.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 2 IoCs
pid Process 1252 MsWebfont.exe 3196 smss.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe MsWebfont.exe File opened for modification C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe MsWebfont.exe File created C:\Program Files (x86)\Windows Defender\de-DE\9e8d7a4ca61bd9 MsWebfont.exe File created C:\Program Files (x86)\Windows Defender\es-ES\cmd.exe MsWebfont.exe File created C:\Program Files (x86)\Windows Defender\es-ES\ebf1f9fa8afd6d MsWebfont.exe File created C:\Program Files (x86)\Windows Defender\de-DE\smss.exe MsWebfont.exe File created C:\Program Files (x86)\Windows Defender\de-DE\69ddcba757bf72 MsWebfont.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5216ca61384f1d0eaa9b873e0b756f0b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings 5216ca61384f1d0eaa9b873e0b756f0b.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4904 schtasks.exe 4372 schtasks.exe 3972 schtasks.exe 208 schtasks.exe 4852 schtasks.exe 4288 schtasks.exe 4892 schtasks.exe 2868 schtasks.exe 2428 schtasks.exe 3508 schtasks.exe 1980 schtasks.exe 224 schtasks.exe 3696 schtasks.exe 1856 schtasks.exe 4336 schtasks.exe 1720 schtasks.exe 3952 schtasks.exe 1456 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1252 MsWebfont.exe 1252 MsWebfont.exe 1252 MsWebfont.exe 3196 smss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1252 MsWebfont.exe Token: SeDebugPrivilege 3196 smss.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2656 1612 5216ca61384f1d0eaa9b873e0b756f0b.exe 85 PID 1612 wrote to memory of 2656 1612 5216ca61384f1d0eaa9b873e0b756f0b.exe 85 PID 1612 wrote to memory of 2656 1612 5216ca61384f1d0eaa9b873e0b756f0b.exe 85 PID 2656 wrote to memory of 2704 2656 WScript.exe 91 PID 2656 wrote to memory of 2704 2656 WScript.exe 91 PID 2656 wrote to memory of 2704 2656 WScript.exe 91 PID 2704 wrote to memory of 1252 2704 cmd.exe 93 PID 2704 wrote to memory of 1252 2704 cmd.exe 93 PID 1252 wrote to memory of 3196 1252 MsWebfont.exe 115 PID 1252 wrote to memory of 3196 1252 MsWebfont.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5216ca61384f1d0eaa9b873e0b756f0b.exe"C:\Users\Admin\AppData\Local\Temp\5216ca61384f1d0eaa9b873e0b756f0b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Msdhcp\kYflM234aT9Hkuk3JQCzywjVnA9.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Msdhcp\tQvStNv.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Msdhcp\MsWebfont.exe"C:\Msdhcp\MsWebfont.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files (x86)\Windows Defender\de-DE\smss.exe"C:\Program Files (x86)\Windows Defender\de-DE\smss.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Msdhcp\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Msdhcp\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Msdhcp\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
827KB
MD5ec7c50f1bebb1402b88fa756af1b3f4c
SHA182e1c02d54d7212efe8c6cdb40b811a134900bf0
SHA2569d96e194f9c8eaae557943041df2f29f88a4557b4f2e79b2d89a149ad8e93ab1
SHA51297bb7773be2d5471ba49914f2ab698e4c0142a001cd5fface4fca189cea22cb77c856bd314d97b574216e756219a72c541efa7084ffdbb924a2b578c3aa1bf02
-
Filesize
190B
MD54879ca936544d01129cb0dec0b708d3d
SHA153122a833a136039a3c3ace69fff24fb10e6e6c5
SHA2563db689b9b2dbb3730a26f8b7a4d9e9724aac2c24810015e41c1b5ba73681a724
SHA5128097473a86ed3d72fe70ae1fe269f217632a36d27f074ba4317fd98d529cd390ee6c890e560a8728e386158b8ea83d3f6c1d9a739dbe282e7e0bac1052b7e47c
-
Filesize
25B
MD51b3f947bdc497eb9f7fa4d4f975e3354
SHA1c3114bc2b359b592dda481bf881c64b45d15c641
SHA2562e71a1366a0e31635d8c67f168aeefe58eaed85aaf91762c52d2da837232f4d3
SHA5128552c68c08ce5f70c8d8b8e360dfdf607142684fa046d1c434207d07cbf5a6262ff5d8b505ce8413d76da7e5954db4fd7d9f15bea7fe367ad2d0a731a2983ded