Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 07:28
Behavioral task
behavioral1
Sample
eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe
Resource
win10v2004-20241007-en
General
-
Target
eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe
-
Size
1.3MB
-
MD5
85557604dc44ef6128cf359f9516a773
-
SHA1
ccc47c852610d56888b86a89fb2efbd881348f73
-
SHA256
eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1
-
SHA512
4a868472b6d325557ce4556b019dfde667956d64bc91f312af2e6a9ae1fa6640afd7e6ee5c4a1ef26e7356e704c5395eddeee372b250ac1973bd613b8c38346c
-
SSDEEP
24576:U2G/nvxW3Ww0t5N7MCHS/+tqnmJZqmsIma/59qihru6Lc+4Z:UbA30jMAl74mHWiBbc
Malware Config
Signatures
-
DcRat 7 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe 1356 schtasks.exe 2236 schtasks.exe 3308 schtasks.exe 1836 schtasks.exe 4060 schtasks.exe 4208 schtasks.exe -
Dcrat family
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1356 2268 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2236 2268 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3308 2268 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1836 2268 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 2268 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4208 2268 schtasks.exe 89 -
resource yara_rule behavioral2/files/0x000a000000023b69-10.dat dcrat behavioral2/memory/4216-13-0x0000000000510000-0x000000000061C000-memory.dmp dcrat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation fontreviewwinsvcrefPerfdll.exe -
Executes dropped EXE 2 IoCs
pid Process 4216 fontreviewwinsvcrefPerfdll.exe 3652 conhost.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\netman\\RuntimeBroker.exe\"" fontreviewwinsvcrefPerfdll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\dafBth\\dllhost.exe\"" fontreviewwinsvcrefPerfdll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\TtlsCfg\\dllhost.exe\"" fontreviewwinsvcrefPerfdll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\shutdownext\\conhost.exe\"" fontreviewwinsvcrefPerfdll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\PerfLogs\\SppExtComObj.exe\"" fontreviewwinsvcrefPerfdll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.pt-br\\OfficeClickToRun.exe\"" fontreviewwinsvcrefPerfdll.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\System32\dafBth\dllhost.exe fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\dafBth\5940a34987c99120d96dace90a3f93f329dcad63 fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\TtlsCfg\dllhost.exe fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\netman\RuntimeBroker.exe fontreviewwinsvcrefPerfdll.exe File opened for modification C:\Windows\System32\netman\RuntimeBroker.exe fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\netman\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\TtlsCfg\5940a34987c99120d96dace90a3f93f329dcad63 fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\shutdownext\conhost.exe fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\shutdownext\088424020bedd6b28ac7fd22ee35dcd7322895ce fontreviewwinsvcrefPerfdll.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br\OfficeClickToRun.exe fontreviewwinsvcrefPerfdll.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br\e6c9b481da804f07baff8eff543b0a1441069b5d fontreviewwinsvcrefPerfdll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1356 schtasks.exe 2236 schtasks.exe 3308 schtasks.exe 1836 schtasks.exe 4060 schtasks.exe 4208 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4216 fontreviewwinsvcrefPerfdll.exe 4216 fontreviewwinsvcrefPerfdll.exe 4216 fontreviewwinsvcrefPerfdll.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe 3652 conhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4216 fontreviewwinsvcrefPerfdll.exe Token: SeDebugPrivilege 3652 conhost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1140 wrote to memory of 2680 1140 eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe 82 PID 1140 wrote to memory of 2680 1140 eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe 82 PID 1140 wrote to memory of 2680 1140 eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe 82 PID 2680 wrote to memory of 1116 2680 WScript.exe 85 PID 2680 wrote to memory of 1116 2680 WScript.exe 85 PID 2680 wrote to memory of 1116 2680 WScript.exe 85 PID 1116 wrote to memory of 4216 1116 cmd.exe 87 PID 1116 wrote to memory of 4216 1116 cmd.exe 87 PID 4216 wrote to memory of 3652 4216 fontreviewwinsvcrefPerfdll.exe 96 PID 4216 wrote to memory of 3652 4216 fontreviewwinsvcrefPerfdll.exe 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe"C:\Users\Admin\AppData\Local\Temp\eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe"1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\fontreviewwinsvc\HZSUF0ENoqATgs2xuBB5SnvQ30qsZ.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\fontreviewwinsvc\JAvevGsJOHZ7p.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\fontreviewwinsvc\fontreviewwinsvcrefPerfdll.exe"C:\fontreviewwinsvc\fontreviewwinsvcrefPerfdll.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\System32\shutdownext\conhost.exe"C:\Windows\System32\shutdownext\conhost.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\netman\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\dafBth\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\TtlsCfg\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\shutdownext\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\PerfLogs\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206B
MD56516a4960a6cd91391f10cdd67452a43
SHA149df369838b52c8f393602685e3598474b0c8894
SHA256e4eaa44532ad70a2f8f8f92b474a262a8f30eadbe46e9afcbc960be15dc32c53
SHA512c3ccef7b360c776486e9d9173adef25a9022ad046f52dcbbe4ec56986d989e8bd5a1c0ff64cd68bd48065557cb505139a221d924c004086f2f821fb683147271
-
Filesize
52B
MD522db99b6cb738df9778a2cbaea5c8d65
SHA1317794f9120a203cef9d4a54c8b03a945a3e285b
SHA2564af63f08cbfb0666776f281d9bc73c766d911580061048e59ea6ea7093d65f88
SHA5128ab77efc664b9617e11dd707beea570960395a08b721bd2f81d9bfc3740e72b0ced58da3e5b870ca550435f3aec2df4e144a27d1fb9f001a41ec51f66a5afec9
-
Filesize
1.0MB
MD5193a3f45ff80ed77a5c041e5f1f1beb7
SHA17ff88a38ee281b02b7f5279d2cd801e647becd73
SHA25603c5a982b0c3cd3144eaaff24b52a6480f4dc0680f0a006cf59f20565e7497ce
SHA51220f067f2f552cd19f71519e86fc2b1f2dc7c31a7aa8c22400cba7a7a985b3c61ce659d1bfbf3762bb90ff451f8678d7c7d3a1c26f3280a9d7289c0fb8aa6218b