Overview

overview

10

Static

static

10

a614856064...18.exe

windows7-x64

10

a614856064...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2024 05:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a61485606418948d428d99dc0a40d4b7_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    a61485606418948d428d99dc0a40d4b7

  • SHA1

    a670ba1214d5637214ed5578bb31e67fcab6f3ed

  • SHA256

    2c638458e811cb805b444407dadcfd75f7e45b5711e2395cef26cf31f8f3fe2c

  • SHA512

    65dde767f795c316f8b394c164cfa1f22e3573c1e500b98ae345edfe37a34e0be698bfa252b32607f95bbb72a2a8f3992778f703fbba8b5bcfa101952a609e05

  • SSDEEP

    24576:92HvItsNMDCUh1W+bn0UEeytTFZvWdcDrkbf+4:9a9O1WWn0UE1ysQy

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Drops file in System32 directory 7 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a61485606418948d428d99dc0a40d4b7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a61485606418948d428d99dc0a40d4b7_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Program Files (x86)\Uninstall Information\a61485606418948d428d99dc0a40d4b7_JaffaCakes118.exe
      "C:\Program Files (x86)\Uninstall Information\a61485606418948d428d99dc0a40d4b7_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2512
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\chgport\dwm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2928
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\WebClnt\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2996
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\prnfldr\services.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2868
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3052
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "a61485606418948d428d99dc0a40d4b7_JaffaCakes118" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\a61485606418948d428d99dc0a40d4b7_JaffaCakes118.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2712
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\ProgramData\Microsoft Help\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Uninstall Information\a61485606418948d428d99dc0a40d4b7_JaffaCakes118.exe
    Filesize

    1.1MB

    MD5

    a61485606418948d428d99dc0a40d4b7

    SHA1

    a670ba1214d5637214ed5578bb31e67fcab6f3ed

    SHA256

    2c638458e811cb805b444407dadcfd75f7e45b5711e2395cef26cf31f8f3fe2c

    SHA512

    65dde767f795c316f8b394c164cfa1f22e3573c1e500b98ae345edfe37a34e0be698bfa252b32607f95bbb72a2a8f3992778f703fbba8b5bcfa101952a609e05

    Download Submit

  • memory/848-0-0x000007FEF64A3000-0x000007FEF64A4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/848-1-0x0000000000B10000-0x0000000000C28000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/848-2-0x000007FEF64A0000-0x000007FEF6E8C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/848-22-0x000007FEF64A0000-0x000007FEF6E8C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2512-21-0x0000000000090000-0x00000000001A8000-memory.dmp

    Filesize

    1.1MB

    Download