Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 07:31
Behavioral task
behavioral1
Sample
eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe
Resource
win10v2004-20241007-en
General
-
Target
eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe
-
Size
1.3MB
-
MD5
85557604dc44ef6128cf359f9516a773
-
SHA1
ccc47c852610d56888b86a89fb2efbd881348f73
-
SHA256
eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1
-
SHA512
4a868472b6d325557ce4556b019dfde667956d64bc91f312af2e6a9ae1fa6640afd7e6ee5c4a1ef26e7356e704c5395eddeee372b250ac1973bd613b8c38346c
-
SSDEEP
24576:U2G/nvxW3Ww0t5N7MCHS/+tqnmJZqmsIma/59qihru6Lc+4Z:UbA30jMAl74mHWiBbc
Malware Config
Signatures
-
DcRat 5 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe 2256 schtasks.exe 1716 schtasks.exe 1328 schtasks.exe 548 schtasks.exe -
Dcrat family
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 2680 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1716 2680 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1328 2680 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 548 2680 schtasks.exe 34 -
resource yara_rule behavioral1/files/0x00080000000162e9-9.dat dcrat behavioral1/memory/3044-13-0x0000000000DB0000-0x0000000000EBC000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
pid Process 3044 fontreviewwinsvcrefPerfdll.exe -
Loads dropped DLL 2 IoCs
pid Process 2792 cmd.exe 2792 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\wdi\\sppsvc.exe\"" fontreviewwinsvcrefPerfdll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\cmd.exe\"" fontreviewwinsvcrefPerfdll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\mciqtz32\\wininit.exe\"" fontreviewwinsvcrefPerfdll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\NlsLexicons004b\\lsass.exe\"" fontreviewwinsvcrefPerfdll.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\System32\wdi\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\mciqtz32\wininit.exe fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\mciqtz32\560854153607923c4c5f107085a7db67be01f252 fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\NlsLexicons004b\lsass.exe fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\NlsLexicons004b\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9 fontreviewwinsvcrefPerfdll.exe File created C:\Windows\System32\wdi\sppsvc.exe fontreviewwinsvcrefPerfdll.exe File opened for modification C:\Windows\System32\wdi\sppsvc.exe fontreviewwinsvcrefPerfdll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1328 schtasks.exe 548 schtasks.exe 2256 schtasks.exe 1716 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe 3044 fontreviewwinsvcrefPerfdll.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3044 fontreviewwinsvcrefPerfdll.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2180 2740 eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe 30 PID 2740 wrote to memory of 2180 2740 eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe 30 PID 2740 wrote to memory of 2180 2740 eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe 30 PID 2740 wrote to memory of 2180 2740 eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe 30 PID 2180 wrote to memory of 2792 2180 WScript.exe 31 PID 2180 wrote to memory of 2792 2180 WScript.exe 31 PID 2180 wrote to memory of 2792 2180 WScript.exe 31 PID 2180 wrote to memory of 2792 2180 WScript.exe 31 PID 2792 wrote to memory of 3044 2792 cmd.exe 33 PID 2792 wrote to memory of 3044 2792 cmd.exe 33 PID 2792 wrote to memory of 3044 2792 cmd.exe 33 PID 2792 wrote to memory of 3044 2792 cmd.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe"C:\Users\Admin\AppData\Local\Temp\eda07f0921abe44f67eff44b1cfb5cfdb13529dc48243a01962c0ad5129d35f1.exe"1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\fontreviewwinsvc\HZSUF0ENoqATgs2xuBB5SnvQ30qsZ.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\fontreviewwinsvc\JAvevGsJOHZ7p.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\fontreviewwinsvc\fontreviewwinsvcrefPerfdll.exe"C:\fontreviewwinsvc\fontreviewwinsvcrefPerfdll.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\wdi\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\mciqtz32\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons004b\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206B
MD56516a4960a6cd91391f10cdd67452a43
SHA149df369838b52c8f393602685e3598474b0c8894
SHA256e4eaa44532ad70a2f8f8f92b474a262a8f30eadbe46e9afcbc960be15dc32c53
SHA512c3ccef7b360c776486e9d9173adef25a9022ad046f52dcbbe4ec56986d989e8bd5a1c0ff64cd68bd48065557cb505139a221d924c004086f2f821fb683147271
-
Filesize
52B
MD522db99b6cb738df9778a2cbaea5c8d65
SHA1317794f9120a203cef9d4a54c8b03a945a3e285b
SHA2564af63f08cbfb0666776f281d9bc73c766d911580061048e59ea6ea7093d65f88
SHA5128ab77efc664b9617e11dd707beea570960395a08b721bd2f81d9bfc3740e72b0ced58da3e5b870ca550435f3aec2df4e144a27d1fb9f001a41ec51f66a5afec9
-
Filesize
1.0MB
MD5193a3f45ff80ed77a5c041e5f1f1beb7
SHA17ff88a38ee281b02b7f5279d2cd801e647becd73
SHA25603c5a982b0c3cd3144eaaff24b52a6480f4dc0680f0a006cf59f20565e7497ce
SHA51220f067f2f552cd19f71519e86fc2b1f2dc7c31a7aa8c22400cba7a7a985b3c61ce659d1bfbf3762bb90ff451f8678d7c7d3a1c26f3280a9d7289c0fb8aa6218b