Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-11-2024 08:33

General

  • Target

    2d756772bc00e5778d794c107358ddf7.exe

  • Size

    1.9MB

  • MD5

    2d756772bc00e5778d794c107358ddf7

  • SHA1

    77229fc9ceeb137c6644a4fa3085aecabaf94ec3

  • SHA256

    a7f4c48301ad6b01c8777427eaceb965a9e0c14d493f44d1dea4f8d498123469

  • SHA512

    31fae1a50618ed221cef3bfc72a017e8e925c3aa2bac727040ee655d9dff567813e91d76fecda0478653d50b8061481447ded77939b94e1ec823c3419b68c783

  • SSDEEP

    24576:S1cKuEoW9iN0TvOJcaCXMgg2Suqp6Nheem6Vuuean7WiOLYGhYJG9oQpyhctpnWq:wb24KbkglgVMm9OAG9oMgctpnW5yI4

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 12 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe
    "C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tomytjwq\tomytjwq.cmdline"
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEBD5.tmp" "c:\Windows\System32\CSC6961F89841684B4D89B24643C968758.TMP"
        3⤵
          PID:2564
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1448
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\lsm.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1496
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2656
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\en-US\spoolsv.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1932
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WmiPrvSE.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1460
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1312
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ihrXNJRNhj.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:768
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2068
          • C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe
            "C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe"
            3⤵
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2172
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2288
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2840
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2916
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\lsm.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2680
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\lsm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2876
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\lsm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3052
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:600
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2928
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1672
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\en-US\spoolsv.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:608
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\en-US\spoolsv.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2764
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\en-US\spoolsv.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2912
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WmiPrvSE.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:468
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:840
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1992
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "2d756772bc00e5778d794c107358ddf72" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2600
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "2d756772bc00e5778d794c107358ddf7" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3060
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "2d756772bc00e5778d794c107358ddf72" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\2d756772bc00e5778d794c107358ddf7.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2200

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe

        Filesize

        1.9MB

        MD5

        2d756772bc00e5778d794c107358ddf7

        SHA1

        77229fc9ceeb137c6644a4fa3085aecabaf94ec3

        SHA256

        a7f4c48301ad6b01c8777427eaceb965a9e0c14d493f44d1dea4f8d498123469

        SHA512

        31fae1a50618ed221cef3bfc72a017e8e925c3aa2bac727040ee655d9dff567813e91d76fecda0478653d50b8061481447ded77939b94e1ec823c3419b68c783

      • C:\Users\Admin\AppData\Local\Temp\RESEBD5.tmp

        Filesize

        1KB

        MD5

        b8e3cf6edbdb16182ea2d56791f9ae86

        SHA1

        b84beae3db6ddc55e68e9d8856e20e1a691461a8

        SHA256

        3c5b849708aae845342331a2cfd1e2053abf4f916dc49cf6d783a2b25f286f67

        SHA512

        c47454f39848614d2848fcef5e9301d459eb0ebb363f0bfb3ad514d2bb651f96ab26568397d7f45833971466ca5429d136e0156272efdcc9e55fe22032620994

      • C:\Users\Admin\AppData\Local\Temp\ihrXNJRNhj.bat

        Filesize

        198B

        MD5

        2ecf2b4b73c45890d4a432ba54421f85

        SHA1

        cba4e53861929528ac522d38350804f28b956f35

        SHA256

        b2336fb8cae429cbb6d4b68fb2ebe85b37a67f31a74db8378173987e85aec678

        SHA512

        dc8d76f82690bba4219a9e34cd4b9c43a55c68ee293383bd00980142006cc4f105147ad0f0e685cdbe32672b602db6dff4487e0411f57b2c94c6fbeff1f42fad

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6WXPNZMHJZYG3STGHQ8A.temp

        Filesize

        7KB

        MD5

        064d8cbf714365db29f0c6c9d9092198

        SHA1

        445b9a9d2fb794a2d8daf1ab5b7c41d0017ede00

        SHA256

        acfd951aa5f2eaba6239ba51b047fa76565757068f5ea9e3fbeb63b9de96c120

        SHA512

        9b8b475453a738ef0b5efa4f0c01f6e69d54c644eb5bb702af46dcc7eee817ae4e6dd674b0cf53e1a7cac8c1bdbd89f81ba18f1f835fbbcd8f3be9ff950c6a73

      • \??\c:\Users\Admin\AppData\Local\Temp\tomytjwq\tomytjwq.0.cs

        Filesize

        393B

        MD5

        859434cc986548e4cc12a985ed4b9d7c

        SHA1

        0e55adb128c730132932e22c2d09b051b78edc6e

        SHA256

        ac030dfc7d98613ab929c99061204181cc62e680f92bc50b0a135c7110c19e41

        SHA512

        d84d78fbb996165939d4e1f34f489db008f227dc1b8a2af1dc32039db7cac351ae74b3cdbb3b0bf709dc51a4ecceb230e05158a041465d430a346ea5dd708559

      • \??\c:\Users\Admin\AppData\Local\Temp\tomytjwq\tomytjwq.cmdline

        Filesize

        235B

        MD5

        0e04494545208ea9d6abf4b3d94135a0

        SHA1

        5f7a57fde8d272d951973865d75d1c9e1ac3e016

        SHA256

        797402ebf9e8289bdc5927630b32b0d456eb8be0a29e526fa9652c4210caea70

        SHA512

        94bb0632f35e310ec5dc4a5f4f3a92876fa23428f08181a1e398fc6792ea6da851bc18b14f75432b7f3fdc24d54b7c5bcbace430dacd38bbe1b45654195e2663

      • \??\c:\Windows\System32\CSC6961F89841684B4D89B24643C968758.TMP

        Filesize

        1KB

        MD5

        8c85ef91c6071d33745325a8fa351c3e

        SHA1

        e3311ceef28823eec99699cc35be27c94eca52d2

        SHA256

        8db3e3a5515da1933036688a9b1918cfc3339fc687008c5325461271904b2d41

        SHA512

        2bb89b07fe46b1c406ed6a560e88cb2b8402b1d61bb71e10887bad661751f64f1e5317fd6c1b301ea4766785b915da31b64e0475cfe36c1f950b32915b5dab7d

      • memory/1224-22-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-6-0x0000000000590000-0x000000000059E000-memory.dmp

        Filesize

        56KB

      • memory/1224-15-0x0000000000B40000-0x0000000000B52000-memory.dmp

        Filesize

        72KB

      • memory/1224-13-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-12-0x0000000000B20000-0x0000000000B38000-memory.dmp

        Filesize

        96KB

      • memory/1224-17-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-16-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-19-0x00000000005A0000-0x00000000005A8000-memory.dmp

        Filesize

        32KB

      • memory/1224-21-0x00000000005B0000-0x00000000005BC000-memory.dmp

        Filesize

        48KB

      • memory/1224-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

        Filesize

        4KB

      • memory/1224-23-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-10-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-7-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-9-0x00000000005C0000-0x00000000005DC000-memory.dmp

        Filesize

        112KB

      • memory/1224-4-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-3-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-47-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

        Filesize

        4KB

      • memory/1224-48-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-49-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-50-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-51-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-2-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-1-0x0000000001260000-0x000000000144E000-memory.dmp

        Filesize

        1.9MB

      • memory/1224-88-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1224-87-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

        Filesize

        9.9MB

      • memory/1932-76-0x0000000001D20000-0x0000000001D28000-memory.dmp

        Filesize

        32KB

      • memory/1932-71-0x000000001B550000-0x000000001B832000-memory.dmp

        Filesize

        2.9MB