Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 02:42
General
-
Target
858fff104da670b640eff2a93b7fa4b794ae554c30a409864d00f3b7ecc1e09f.exe
-
Size
1.6MB
-
MD5
8c6e4c86c216b898f24ff14b417c4369
-
SHA1
266e7d01ba11cd7914451c798199596f4d2f7b53
-
SHA256
858fff104da670b640eff2a93b7fa4b794ae554c30a409864d00f3b7ecc1e09f
-
SHA512
3f6416bf0b7989b522d399e151cc755783b9b7afe9cde559f8207fad6c043e24f85b22c3a583329e1620e862c7824249c536209b6be5e093a2b580c2fc52f660
-
SSDEEP
24576:o2a0H/WPj+rsO6AOhaDxL/aySUYj79FcPX6t1:va0SKsOP1L/KzEP
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies registry class 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\858fff104da670b640eff2a93b7fa4b794ae554c30a409864d00f3b7ecc1e09f.exe"C:\Users\Admin\AppData\Local\Temp\858fff104da670b640eff2a93b7fa4b794ae554c30a409864d00f3b7ecc1e09f.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sbxFyBgGCn.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171B
MD596b859b053c0408273a24c1378f500ee
SHA10dc4171baa590ace20da21a4451c33c7bb36fc0f
SHA256af1f83a755276cda6992277dc77b44ade12d0236e1f97a74e665cc21f6caa0be
SHA512e67b6ff0013b7a181d0eb94fda9014777fc44a12a4e7446fb7a0e43523eb457611153e47c46d9ddeec91521e7050751d97c6e50ef40b257d5133f03c6e215ee0
-
Filesize
1.6MB
MD58c6e4c86c216b898f24ff14b417c4369
SHA1266e7d01ba11cd7914451c798199596f4d2f7b53
SHA256858fff104da670b640eff2a93b7fa4b794ae554c30a409864d00f3b7ecc1e09f
SHA5123f6416bf0b7989b522d399e151cc755783b9b7afe9cde559f8207fad6c043e24f85b22c3a583329e1620e862c7824249c536209b6be5e093a2b580c2fc52f660
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
112KB
-
Filesize
320KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
1.6MB
-
Filesize
112KB
-
Filesize
312KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
360KB
-
Filesize
1.7MB
-
Filesize
1.1MB