Analysis

  • max time kernel
    91s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 13:57

General

  • Target

    a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe

  • Size

    10.1MB

  • MD5

    2ee8eb2b3997b0cce6cc7c562a785719

  • SHA1

    b2d31d2a30815fa0c6dd1e637d7276bfb0547411

  • SHA256

    a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae

  • SHA512

    34ee0171c041205b4b6bb631e0b72fb2f4d3056892281839f0b2e63b9f1997e037755cedd0d56dd64d96ddc878874148611f6eb4ee83238dd560ed59848e8059

  • SSDEEP

    24576:W+O4GptFtiU9SsYm1oO9teGnlcZ/uIO0EdZX0usIW6fgtixy4s+8BIbT19h8OCht:x5o9Y+Iu0u+YoAgO9kK4XyWDAyH6eB

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 11 IoCs
  • Process spawned unexpected child process 11 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 22 IoCs
  • Drops file in System32 directory 16 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe
    "C:\Users\Admin\AppData\Local\Temp\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Users\Admin\AppData\Local\Temp\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe
      "C:\Users\Admin\AppData\Local\Temp\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RbgId1oCFU.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          4⤵
            PID:2948
          • C:\Windows\System32\tcpmon\dwm.exe
            "C:\Windows\System32\tcpmon\dwm.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5016
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\rspndr\unsecapp.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3936
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\regedit\explorer.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1632
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Music\sihost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4876
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Documents and Settings\SearchApp.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3832
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\tcpmon\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4224
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\ProgramData\USOShared\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2192
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\ideograf\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2712
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\licensingdiag\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1080
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\LanguageOverlayServer\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:328
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WmiDcPrv\unsecapp.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3004
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\Mpeg2Data\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1088

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe.log

      Filesize

      1KB

      MD5

      b7c0c43fc7804baaa7dc87152cdc9554

      SHA1

      1bab62bd56af745678d4e967d91e1ccfdeed4038

      SHA256

      46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457

      SHA512

      9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769

    • C:\Users\Admin\AppData\Local\Temp\RbgId1oCFU.bat

      Filesize

      198B

      MD5

      226bdd756748251c1d3043c934703ced

      SHA1

      1c80e92001d3a0ac74c8c6dd757eb5536ca9f43a

      SHA256

      7f8b9df0963529cef51b578a621c602e04917a351a8fdb84a1f4be443eb730c7

      SHA512

      b66aa21b9fb3dbae8cdd42a4552936787c4424297466a5d5d9ed665c60a1bfbf5f077e9a735bae38b4c0d2a060dca5b0be185b7466f629f136e15d60362a850f

    • C:\Windows\System32\tcpmon\dwm.exe

      Filesize

      10.1MB

      MD5

      2ee8eb2b3997b0cce6cc7c562a785719

      SHA1

      b2d31d2a30815fa0c6dd1e637d7276bfb0547411

      SHA256

      a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae

      SHA512

      34ee0171c041205b4b6bb631e0b72fb2f4d3056892281839f0b2e63b9f1997e037755cedd0d56dd64d96ddc878874148611f6eb4ee83238dd560ed59848e8059

    • memory/1608-0-0x00007FFAEEA33000-0x00007FFAEEA35000-memory.dmp

      Filesize

      8KB

    • memory/1608-1-0x0000000000B60000-0x000000000158A000-memory.dmp

      Filesize

      10.2MB

    • memory/1608-4-0x00007FFAEEA30000-0x00007FFAEF4F1000-memory.dmp

      Filesize

      10.8MB

    • memory/1608-13-0x00007FFAEEA30000-0x00007FFAEF4F1000-memory.dmp

      Filesize

      10.8MB

    • memory/5016-36-0x00000000036F0000-0x00000000036FC000-memory.dmp

      Filesize

      48KB

    • memory/5016-37-0x0000000003700000-0x000000000370C000-memory.dmp

      Filesize

      48KB

    • memory/5016-38-0x0000000003710000-0x000000000371C000-memory.dmp

      Filesize

      48KB

    • memory/5016-40-0x0000000003730000-0x000000000373A000-memory.dmp

      Filesize

      40KB

    • memory/5016-39-0x0000000003720000-0x0000000003728000-memory.dmp

      Filesize

      32KB