Analysis
-
max time kernel
118s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
01-12-2024 02:39
General
-
Target
7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
-
Size
1.8MB
-
MD5
4f964ada28fa2dde5c75d3c3682e69c4
-
SHA1
481a0ddc3dfd39147abf684b60b6a0b1dfbbc341
-
SHA256
7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945
-
SHA512
ab07c9602776dc062599a89eed9d38be2c95f563a9ed9c906e6c1066f80e5666f119c5a790a120bf626a73edd3cc178924262d41c0f65eb20fcf3b542a83dc68
-
SSDEEP
24576:cWrCg/r+6/5OZr1A+KnhQaPNcHxIpjgqJ6t1:XrC7G5g0gq
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe"C:\Users\Admin\AppData\Local\Temp\7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hns5laec\hns5laec.cmdline"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC311.tmp" "c:\Windows\System32\CSC5C2B7135CA4B401D9027B07CCCCB4EB.TMP"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uvMahFfpeO.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Admin\AppData\Local\updater.exe"C:\Users\Admin\AppData\Local\updater.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "updateru" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "updater" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "updateru" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bd42d53962ea320cfe37ee8bd0c5f824
SHA1f7912ad2970b935114d4a443665e708d6f6a0ef9
SHA256accc738b85e727e24f6e2daef07cb6137cb2a138667baa9fa930fe2ac194591f
SHA512f90fae3c8c4f07acf5170ddfc0df850bdb6c2d43214a3e8da3e5d43677ae902605bc07188b9b3f9f7a324fdbdecb876ccf2ba36fb067be746ca909849df576bc
-
Filesize
216B
MD537980492e2935c1d0f7dcd7f805d4e71
SHA149f5be0ea907475ee092a072ed78a72cefb9a94e
SHA2560ac46facd7aefffe3bb7bdf3312f32da631eed2c4e4cddbf89efbb5d2f264309
SHA5120206b6bc8381aee28df10dca876b97227d577e7e14287ba96a4cb6614b8c92a3bd625ea1a43db4780f970ac3c088225c58a73af19b0dce4d9106a22fbc850891
-
Filesize
1.8MB
MD54f964ada28fa2dde5c75d3c3682e69c4
SHA1481a0ddc3dfd39147abf684b60b6a0b1dfbbc341
SHA2567b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945
SHA512ab07c9602776dc062599a89eed9d38be2c95f563a9ed9c906e6c1066f80e5666f119c5a790a120bf626a73edd3cc178924262d41c0f65eb20fcf3b542a83dc68
-
Filesize
372B
MD579c763424742ce6d91e774683ce71eb9
SHA17790950bc16f52fe841112b0eadf525865f53260
SHA2560ef02d395939903deb409511ee7dea7309316c853c5c24eeea1ce6eb4e612a50
SHA512e82f7ed5642ca44f3191b857ad798ac6083e9c981bf610df6ed1df87edc01f3e11d5cb41446e01d3b1bc2b53953263992fde5849182c5b6c7fd35d6278b218e5
-
Filesize
235B
MD549578e54be37bcfafc6253788cf25517
SHA1a28b6e9193a89f92b14deabea23ee54a44685759
SHA256feb3f0d029cda39a13ab7ff3f58b05826a97510c8ad384283d464ed91b53c418
SHA512ab0923a8f4b32aca245b2f58304f7819dc40abb5cd752458f88cfca2ff413e5e4b0e12cd2b91d14e78565fce771d8caa5cb8ad3290a35fdf45d398aaf0b688b0
-
Filesize
1KB
MD5fccbcfaf29fdccaabada579f7aaf3ae7
SHA1f9b179b6aab6b96908d89b35aab3f503478a956d
SHA256e70bc8ad14a70d490fe92ed86e79c40fc133a64428a2781e14514b16d83a9b02
SHA512ac047b4ba060e72e224c1afdebbdafecbfd705a67cb8f0cd5c82bf7980c2baa23bdb5bf5d821836bc0c426069a61d8e112b45239887d2d81b8a6d4fa839c1e10
-
Filesize
1.8MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
56KB
-
Filesize
312KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
1.8MB