Analysis

  • max time kernel
    93s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-11-2024 21:59

General

  • Target

    d948b3030803875b8eb8c3e00c627e85bcaacccc6307b95da2b1425cb5f45e28N.exe

  • Size

    1.7MB

  • MD5

    914dc39aa181253e11c186005dfe98f0

  • SHA1

    0b63a5f139884cf75bca3b7d0b1380f9d0a8a700

  • SHA256

    d948b3030803875b8eb8c3e00c627e85bcaacccc6307b95da2b1425cb5f45e28

  • SHA512

    432d25441d27cd7f4ce39835d0d2e4354ab84d390bf04941d6fa65dab99cbd1a908ab64641faf7366f9fb242ed0777f8d446c6f5808c375d39d36e6471c7c479

  • SSDEEP

    24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:NgwuuEpdDLNwVMeXDL0fdSzAG

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d948b3030803875b8eb8c3e00c627e85bcaacccc6307b95da2b1425cb5f45e28N.exe
    "C:\Users\Admin\AppData\Local\Temp\d948b3030803875b8eb8c3e00c627e85bcaacccc6307b95da2b1425cb5f45e28N.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2124
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4996
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4876
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3724
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4336
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4392
    • C:\Users\Default\AppData\sysmon.exe
      "C:\Users\Default\AppData\sysmon.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a4141d2-12f3-4cbf-b97d-fd7b35f97485.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\Users\Default\AppData\sysmon.exe
          C:\Users\Default\AppData\sysmon.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2860
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d50c8e08-f028-4abf-93ac-36f74854a013.vbs"
        3⤵
          PID:336
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\Default\AppData\sysmon.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:900
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\AppData\sysmon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3300
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Users\Default\AppData\sysmon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2740
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3808
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:8
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1188

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log

      Filesize

      1KB

      MD5

      3ad9a5252966a3ab5b1b3222424717be

      SHA1

      5397522c86c74ddbfb2585b9613c794f4b4c3410

      SHA256

      27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249

      SHA512

      b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      6c47b3f4e68eebd47e9332eebfd2dd4e

      SHA1

      67f0b143336d7db7b281ed3de5e877fa87261834

      SHA256

      8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

      SHA512

      0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      3a6bad9528f8e23fb5c77fbd81fa28e8

      SHA1

      f127317c3bc6407f536c0f0600dcbcf1aabfba36

      SHA256

      986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

      SHA512

      846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      d28a889fd956d5cb3accfbaf1143eb6f

      SHA1

      157ba54b365341f8ff06707d996b3635da8446f7

      SHA256

      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

      SHA512

      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      bd5940f08d0be56e65e5f2aaf47c538e

      SHA1

      d7e31b87866e5e383ab5499da64aba50f03e8443

      SHA256

      2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

      SHA512

      c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

    • C:\Users\Admin\AppData\Local\Temp\7a4141d2-12f3-4cbf-b97d-fd7b35f97485.vbs

      Filesize

      711B

      MD5

      2eb4be9c74c63d42c744f96b0aa98d42

      SHA1

      0b0e1267e9d2ae5da9b552733064ee78ce701cc4

      SHA256

      2b4bbe4551c49647fb5e54baa0cb62e856f61a61c6a20ed089047914955a7cc0

      SHA512

      2bece66b5b2335b09cfecc8391538a8399dea84e09b4d7deef25a6c6302c1ecb60441fa9e598197bd351fd0afbbbdedb8d7d89d03846979815c15c632dbb0487

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jbgcapuf.i2y.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\d50c8e08-f028-4abf-93ac-36f74854a013.vbs

      Filesize

      487B

      MD5

      e7edd7f25c18e86512854566fb193639

      SHA1

      e5d52f414bbafe0675116a582460340fda4618aa

      SHA256

      7133042dab630d07d6419ec5fd60cef1ec5d2f49b88905b39316a6a13ae6f0b0

      SHA512

      d3bbe9a3cfa9c65dbd5a8a70d770d7a11f06cf42a33f77a780cbc3e9576ea1afbeafa6fb20a8184d7448c956d9ae0d771c7d0dc3195239c588dfc3bc7e9328ea

    • C:\Users\Default\AppData\sysmon.exe

      Filesize

      1.7MB

      MD5

      914dc39aa181253e11c186005dfe98f0

      SHA1

      0b63a5f139884cf75bca3b7d0b1380f9d0a8a700

      SHA256

      d948b3030803875b8eb8c3e00c627e85bcaacccc6307b95da2b1425cb5f45e28

      SHA512

      432d25441d27cd7f4ce39835d0d2e4354ab84d390bf04941d6fa65dab99cbd1a908ab64641faf7366f9fb242ed0777f8d446c6f5808c375d39d36e6471c7c479

    • memory/2104-215-0x000000001C0D0000-0x000000001C0E2000-memory.dmp

      Filesize

      72KB

    • memory/2192-109-0x00000172861B0000-0x00000172861D2000-memory.dmp

      Filesize

      136KB

    • memory/2860-251-0x000000001BE10000-0x000000001BE22000-memory.dmp

      Filesize

      72KB

    • memory/3916-4-0x000000001BD40000-0x000000001BD90000-memory.dmp

      Filesize

      320KB

    • memory/3916-10-0x000000001BD10000-0x000000001BD1C000-memory.dmp

      Filesize

      48KB

    • memory/3916-17-0x000000001C6D0000-0x000000001C6DC000-memory.dmp

      Filesize

      48KB

    • memory/3916-16-0x000000001BDB0000-0x000000001BDB8000-memory.dmp

      Filesize

      32KB

    • memory/3916-15-0x000000001BDA0000-0x000000001BDAA000-memory.dmp

      Filesize

      40KB

    • memory/3916-19-0x00007FFCCF6B0000-0x00007FFCD0171000-memory.dmp

      Filesize

      10.8MB

    • memory/3916-22-0x00007FFCCF6B0000-0x00007FFCD0171000-memory.dmp

      Filesize

      10.8MB

    • memory/3916-11-0x000000001BD20000-0x000000001BD28000-memory.dmp

      Filesize

      32KB

    • memory/3916-13-0x000000001BD90000-0x000000001BD9C000-memory.dmp

      Filesize

      48KB

    • memory/3916-14-0x000000001C700000-0x000000001C70C000-memory.dmp

      Filesize

      48KB

    • memory/3916-214-0x00007FFCCF6B0000-0x00007FFCD0171000-memory.dmp

      Filesize

      10.8MB

    • memory/3916-18-0x000000001C6E0000-0x000000001C6EC000-memory.dmp

      Filesize

      48KB

    • memory/3916-9-0x000000001BD30000-0x000000001BD40000-memory.dmp

      Filesize

      64KB

    • memory/3916-0-0x00007FFCCF6B3000-0x00007FFCCF6B5000-memory.dmp

      Filesize

      8KB

    • memory/3916-5-0x0000000003110000-0x0000000003118000-memory.dmp

      Filesize

      32KB

    • memory/3916-6-0x00000000031A0000-0x00000000031B0000-memory.dmp

      Filesize

      64KB

    • memory/3916-7-0x000000001BCF0000-0x000000001BD06000-memory.dmp

      Filesize

      88KB

    • memory/3916-8-0x0000000003200000-0x0000000003212000-memory.dmp

      Filesize

      72KB

    • memory/3916-3-0x0000000003180000-0x000000000319C000-memory.dmp

      Filesize

      112KB

    • memory/3916-2-0x00007FFCCF6B0000-0x00007FFCD0171000-memory.dmp

      Filesize

      10.8MB

    • memory/3916-1-0x0000000000EE0000-0x0000000001096000-memory.dmp

      Filesize

      1.7MB