Analysis

  • max time kernel
    112s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2024 18:12

General

  • Target

    cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe

  • Size

    1.6MB

  • MD5

    a9ccc8eefd0a09f70dc9e929fd7d3f20

  • SHA1

    594a474233d4462cbaeabe4fca98e6869e9efff2

  • SHA256

    cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0

  • SHA512

    91781525d2c54f101d8ba898af7f4f95c3d412bc0fd3793675b2fac4c598219234b6d0acee3d4f27016a424884615c410be644b1e563db1d102b99a8f92b9f27

  • SSDEEP

    24576:Wr3+VTI7YmAX6LGRwQHly8XIrDExXGLwiDZ1G/MdeZ75+mHxeipjsRn6Nil:WUS9ZDExWNtM/MdeZ77ej6c

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
    "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9kxNjJdbnL.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2168
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2960
        • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
          "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2896
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pv802QeGaw.bat"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2828
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:2564
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                5⤵
                  PID:2536
                • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
                  "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1552
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hUEgB0oRYu.bat"
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2260
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      7⤵
                        PID:1516
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        7⤵
                          PID:2868
                        • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
                          "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2316
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KU0xjXjpGp.bat"
                            8⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1496
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              9⤵
                                PID:2120
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                9⤵
                                  PID:2676
                                • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
                                  "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
                                  9⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2348
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Y7WGTL1T5.bat"
                                    10⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1304
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      11⤵
                                        PID:2508
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        11⤵
                                          PID:2308
                                        • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
                                          "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
                                          11⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:1532
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5tk1CddJ7G.bat"
                                            12⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1260
                                            • C:\Windows\system32\chcp.com
                                              chcp 65001
                                              13⤵
                                                PID:2064
                                              • C:\Windows\system32\PING.EXE
                                                ping -n 10 localhost
                                                13⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:1992
                                              • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
                                                "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
                                                13⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2732
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KtA3LkY0CV.bat"
                                                  14⤵
                                                    PID:1996
                                                    • C:\Windows\system32\chcp.com
                                                      chcp 65001
                                                      15⤵
                                                        PID:2532
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        15⤵
                                                          PID:2264
                                                        • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
                                                          15⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2388
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RyWKKAFqhq.bat"
                                                            16⤵
                                                              PID:536
                                                              • C:\Windows\system32\chcp.com
                                                                chcp 65001
                                                                17⤵
                                                                  PID:1756
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  17⤵
                                                                    PID:888
                                                                  • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
                                                                    17⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1256
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IzyQn8pRfl.bat"
                                                                      18⤵
                                                                        PID:1456
                                                                        • C:\Windows\system32\chcp.com
                                                                          chcp 65001
                                                                          19⤵
                                                                            PID:584
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            19⤵
                                                                              PID:2936
                                                                            • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
                                                                              19⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2168
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FVJApcqkHv.bat"
                                                                                20⤵
                                                                                  PID:2952
                                                                                  • C:\Windows\system32\chcp.com
                                                                                    chcp 65001
                                                                                    21⤵
                                                                                      PID:2836
                                                                                    • C:\Windows\system32\PING.EXE
                                                                                      ping -n 10 localhost
                                                                                      21⤵
                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                      • Runs ping.exe
                                                                                      PID:2832
                                                                                    • C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
                                                                                      21⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2252
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m961u58njg.bat"
                                                                                        22⤵
                                                                                          PID:2548
                                                                                          • C:\Windows\system32\chcp.com
                                                                                            chcp 65001
                                                                                            23⤵
                                                                                              PID:2988
                                                                                            • C:\Windows\system32\PING.EXE
                                                                                              ping -n 10 localhost
                                                                                              23⤵
                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                              • Runs ping.exe
                                                                                              PID:1316

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\ProgramData\OSPPSVC.exe

                                                  Filesize

                                                  1.6MB

                                                  MD5

                                                  a9ccc8eefd0a09f70dc9e929fd7d3f20

                                                  SHA1

                                                  594a474233d4462cbaeabe4fca98e6869e9efff2

                                                  SHA256

                                                  cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0

                                                  SHA512

                                                  91781525d2c54f101d8ba898af7f4f95c3d412bc0fd3793675b2fac4c598219234b6d0acee3d4f27016a424884615c410be644b1e563db1d102b99a8f92b9f27

                                                • C:\Users\Admin\AppData\Local\Temp\5tk1CddJ7G.bat

                                                  Filesize

                                                  231B

                                                  MD5

                                                  58aec97a759d65a4c707d7b022ade03c

                                                  SHA1

                                                  4167746373f0c685f3265745db3c5ad44ed2b9e3

                                                  SHA256

                                                  2846c1f421c8495ff02248abb024dabbf7457c59c9d66f5920f29313b6641019

                                                  SHA512

                                                  c64eb5f1b0b1fdc36b30bb1d48915680429c694125980fd175a39b1a93d41bb0483574d1a023fa34ba2e96a530b1890b7f02894772201e3b95e8db53b15d527d

                                                • C:\Users\Admin\AppData\Local\Temp\6Y7WGTL1T5.bat

                                                  Filesize

                                                  279B

                                                  MD5

                                                  ef77506f1c4a9fda721b2afc2b248d6e

                                                  SHA1

                                                  3d625fa5dd9291a01c09a7c59b7e3d0a4a95a784

                                                  SHA256

                                                  10dc252178881efa287051227fb4df5dfccc992441516ec479042d01482470a4

                                                  SHA512

                                                  1356fa1e08cddf8ab4b911b64deaec176f629ca82acfb1c66c38f5b521ee5a458f017c35cd4d08105700a6c8bbee0142901bf2106ba5849125e2339774d92ed9

                                                • C:\Users\Admin\AppData\Local\Temp\9kxNjJdbnL.bat

                                                  Filesize

                                                  231B

                                                  MD5

                                                  194f2a331bf8d83b19cf05392fc382bd

                                                  SHA1

                                                  3fc5854ba3e341ebab386900444517faab50f72d

                                                  SHA256

                                                  92d51966e49e88060181832b541db9ae7908858881320e317c8313f380cb6b85

                                                  SHA512

                                                  768a5bd660357b6781d38e518e0a2957285268aec39e6d64a558d423162fd5692b8831d85bee2417566ad3502d868641a310b765dc2fabfc47f675ff3f84d66e

                                                • C:\Users\Admin\AppData\Local\Temp\FVJApcqkHv.bat

                                                  Filesize

                                                  231B

                                                  MD5

                                                  6fbab1fddd158129dc153c20574ef829

                                                  SHA1

                                                  2859e5ad67dd1cbda1bc9a791976c97caf5f1904

                                                  SHA256

                                                  1eff3e5cbed3005b40ceac2378297cc2ede2d4dfd6433ca32dcdf1fd412a6390

                                                  SHA512

                                                  a29d4c707def874590e8b04edc0a84420120addfb85884ebb7b9e700f05874e46a2a45e08691ca5a705af8f5ac99c682481e0c41208741be1dae7e85c6aa1743

                                                • C:\Users\Admin\AppData\Local\Temp\IzyQn8pRfl.bat

                                                  Filesize

                                                  279B

                                                  MD5

                                                  4ff98e6037752a06bba594e944f9b68b

                                                  SHA1

                                                  1bb4023e9eacc77f4904e7ce11a2b80ea339b437

                                                  SHA256

                                                  009a1159e1ee531284cade05c8f86c64a1685953bffdba7345c591d8550d533f

                                                  SHA512

                                                  2557649ddf64d8117baf59d8e24ef1e3106b3f9c02d9547d2b2a3c1bee54cb65badd9cb3d4ab1fd7c9a20441ae0b6bff250818095ae075349ffcdb8b212074e7

                                                • C:\Users\Admin\AppData\Local\Temp\KU0xjXjpGp.bat

                                                  Filesize

                                                  279B

                                                  MD5

                                                  01e932f982317ba47bad474400674847

                                                  SHA1

                                                  d802c5133a540c4eadf8c7a86a510f39b43cf912

                                                  SHA256

                                                  e8dcb4caaa305cad34deeb5b7d8bc0dbdacf4bfbde589be36355238806263ef9

                                                  SHA512

                                                  0e90be4d301b37db12f1a4d24d05804bd738f254d9de8096c33d05b374c3e74948ad3e82f40144d6b13e14e5a522465f9bdb08d412f7b80b21bd08f1ea17033e

                                                • C:\Users\Admin\AppData\Local\Temp\KtA3LkY0CV.bat

                                                  Filesize

                                                  279B

                                                  MD5

                                                  de07b47f36bed585ea68ebe811b7a9f9

                                                  SHA1

                                                  05338bb3e69513f55c0b70b923dcfa65cc22974e

                                                  SHA256

                                                  8370fb7646aa95b7113ed166c9113ca923561843bc109211de0466dddad121c4

                                                  SHA512

                                                  76c9d378b9dec5f4e4495d17214ece02718efc0ef3a18a65ddb956615263d1ea06cbd36a1e891db57f5833993884dd7ab2f103a8a25298b261988c9a2cb19336

                                                • C:\Users\Admin\AppData\Local\Temp\RyWKKAFqhq.bat

                                                  Filesize

                                                  279B

                                                  MD5

                                                  3ba2999eadb411055ee8f4351463a1fc

                                                  SHA1

                                                  84baa476bb61c5817e3c6116c02daa9088566a65

                                                  SHA256

                                                  4d2d3a34f259f9cc537a9281c5f1b72ca7aa48f3b15717f8cb5e0f0bb36016ea

                                                  SHA512

                                                  9b75242f8b86eb29db65271613fa09132736bf1243a5e7453ac4966b88937e84307cb347a8e54b305f8b43a4a6cb9f6b5b87b067e50105e6d3ec2801d4f66ca5

                                                • C:\Users\Admin\AppData\Local\Temp\hUEgB0oRYu.bat

                                                  Filesize

                                                  279B

                                                  MD5

                                                  2e81c719fae71d5b81a32ea57dd88da3

                                                  SHA1

                                                  478879efe7dd81ac00268e64957fc40d9435bebf

                                                  SHA256

                                                  2a9abdcba7855b8df1fda650f0f7599d8acccf76ca88011f45ffa4b068de9098

                                                  SHA512

                                                  6650bbfe45fed597f0f4348051dda3b94948ee97eb35257d8200caf82dcbf436c3238478c4004727ab87b3539c3872eb92da19ccbc6940276aa9a1aec680f082

                                                • C:\Users\Admin\AppData\Local\Temp\m961u58njg.bat

                                                  Filesize

                                                  231B

                                                  MD5

                                                  0e7184319a12b01c1a07e193fa45b0b9

                                                  SHA1

                                                  e21ce77d9e29c7e5c22719c941f85722cd63e761

                                                  SHA256

                                                  78ff8ac0d5e7062bbcd0a8c97856a26ff2591bc77520c45734783aa95640e94d

                                                  SHA512

                                                  d3ce660f972c3213710947edb7b85486132f975e887b300abe453ec9f50314249e3a9f495696265f050bb3bf1ef8b706beb1613b2ac5eccc827cb166db15aac7

                                                • C:\Users\Admin\AppData\Local\Temp\pv802QeGaw.bat

                                                  Filesize

                                                  279B

                                                  MD5

                                                  422ef1758db4bfe7dc69881f7800f1fc

                                                  SHA1

                                                  6a41624ca28dd6431d49ff6bff63494066c971dc

                                                  SHA256

                                                  2add27911b54ee3229d5d2eb87d5a70763f23fb48c20793649f372a280e5f737

                                                  SHA512

                                                  9d70f954b15889e8f13b5401f1d91f07d99e36efb8592cc33c36e5cbbd22cb7a3b02b2a101bf892616707d15f512e5dfa605f1134532c1af82de15816730394e

                                                • memory/1532-43-0x00000000012F0000-0x0000000001488000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/1552-27-0x0000000001250000-0x00000000013E8000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2116-0-0x000007FEF5A63000-0x000007FEF5A64000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2116-3-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

                                                  Filesize

                                                  9.9MB

                                                • memory/2116-20-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

                                                  Filesize

                                                  9.9MB

                                                • memory/2116-2-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

                                                  Filesize

                                                  9.9MB

                                                • memory/2116-1-0x0000000001090000-0x0000000001228000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2168-67-0x00000000000C0000-0x0000000000258000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2252-73-0x0000000000D80000-0x0000000000F18000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2388-55-0x00000000013A0000-0x0000000001538000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2896-21-0x00000000011D0000-0x0000000001368000-memory.dmp

                                                  Filesize

                                                  1.6MB