Analysis
-
max time kernel
92s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
submitted
30-11-2024 21:16
General
-
Target
kyhjasehs.exe
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\kyhjasehs.exe"C:\Users\Admin\AppData\Local\Temp\kyhjasehs.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qvcd24j2\qvcd24j2.cmdline"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69B6.tmp" "c:\Windows\System32\CSC7F8C95EFBB54D7D907C03328F286F4.TMP"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zGJBD0ryYf.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Admin\AppData\Local\updater.exe"C:\Users\Admin\AppData\Local\updater.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "updateru" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "updater" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "updateru" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5afeb6ab0a087025978fb611e26e98fe0
SHA180d9aa7b7898340ca150a4d1851da8eecafe2954
SHA256855c9c7b9e67651fe0b7dbc8c0070d74e9e342a19a727d70bc9d160ced8b195a
SHA512fa8e54f870c8a8a07b00403e3a188ef264146bafd0c1ca508c98b1729ec589c369395ff22ade8f33cf088f48f54e4a1fb832e5f879566815fb3c7c1f77387f63
-
Filesize
216B
MD56482376cb2a2355e9902c92267d61a11
SHA123e3cedc318923f5afc5d8da4affb24f4e0bfeca
SHA256fdeade8793b7c811215e7244b4f56c0684fb4281f009b2cab21a8876904ab882
SHA512e35c6cd4898977ed619e204c33e1b230a65e088e4f5e56e89f7c86b021e588ba32ba4db4551943e0d1b57c78f86191ebd9b55ea3e9185133e030af129d2c1ffe
-
Filesize
1.8MB
MD54f964ada28fa2dde5c75d3c3682e69c4
SHA1481a0ddc3dfd39147abf684b60b6a0b1dfbbc341
SHA2567b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945
SHA512ab07c9602776dc062599a89eed9d38be2c95f563a9ed9c906e6c1066f80e5666f119c5a790a120bf626a73edd3cc178924262d41c0f65eb20fcf3b542a83dc68
-
Filesize
372B
MD5b5e124198b7654928f22adcc63a2c89c
SHA1ae8bf25b65cc75f05e8b87113839725167e4d16e
SHA256561a1c7e7f9a16877fde541ce83d3f4fe605f5a0e105d8a1f0c0382ad1345054
SHA512488e0c66a3402904b8e66080f6461623a9c34b7f76f0d232bc78ebc8e780c6eab186bd8812f5654299ac143b0a56002125d0108d7fa71472b94475f6106fc989
-
Filesize
235B
MD5246585b86368a702235e6cfda8a4e089
SHA12153e50c8f49691caf1c87b65f839386183dd3ea
SHA256c3efba2c3956d26fd51c3ebe98526e3aef7914e99b177da9bc1358fa7bed2be8
SHA5129577a6c0ff98759603b7ecdf1ef7967fc7b2b73fa15f11fdb41010b0a2624081e6fdb6c70f6c0efc9c9006a1fce149e20ed9cb542f9ff5044738677745512c8c
-
Filesize
1KB
MD55984679060d0fc54eba47cead995f65a
SHA1f72bbbba060ac80ac6abedc7b8679e8963f63ebf
SHA2564104fdf5499f0aa7dd161568257acae002620ec385f2ede2072d4f550ecff433
SHA512bc8aadfabe5dbb4e3ea5e07a5ccbddd363400005675acda3e9cb414dc75fb0ba74f41b4a6baf34d42f85a9ae0af7d2418420c78b0c643f7243fe93a49b8140b5
-
Filesize
10.8MB
-
Filesize
312KB
-
Filesize
10.8MB
-
Filesize
96KB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
8KB
-
Filesize
360KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.8MB