Analysis
-
max time kernel
119s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 15:48
Behavioral task
behavioral1
Sample
mrdgasdthawed.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
mrdgasdthawed.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
mrdgasdthawed.exe
Resource
win11-20241007-en
General
-
Target
mrdgasdthawed.exe
-
Size
560KB
-
MD5
37cb065f052d8cf6a46d41d6225b9a9f
-
SHA1
ffcd01452c4b695f1371787a5c728c692283fca2
-
SHA256
0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01
-
SHA512
8a2850f61af22a40ebb1e11c1d294cd74c94cf3b365619a4588bfbc54362575467cff4a5d75f685354b073453ad9892125739e78468a8dc550e52ccab88df47e
-
SSDEEP
6144:s/9Sb1sKhV/+NZCwUW/mulaEqLhEWRzSyAZW9z9mXbj7Gvvai33Ew8X6Asz6UrZ:sFK1DH/p8l/zWRdP5mfA33EjKf6UrZ
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
DCRat payload 3 IoCs
resource yara_rule behavioral1/memory/2156-1-0x00000000000E0000-0x0000000000172000-memory.dmp family_dcrat_v2 behavioral1/files/0x0007000000012117-14.dat family_dcrat_v2 behavioral1/memory/2800-15-0x00000000012B0000-0x0000000001342000-memory.dmp family_dcrat_v2 -
Executes dropped EXE 1 IoCs
pid Process 2800 staticfile.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2924 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2924 PING.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2800 staticfile.exe 2800 staticfile.exe 2800 staticfile.exe 2800 staticfile.exe 2800 staticfile.exe 2800 staticfile.exe 2800 staticfile.exe 2800 staticfile.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2156 mrdgasdthawed.exe Token: SeDebugPrivilege 2800 staticfile.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2156 wrote to memory of 1424 2156 mrdgasdthawed.exe 30 PID 2156 wrote to memory of 1424 2156 mrdgasdthawed.exe 30 PID 2156 wrote to memory of 1424 2156 mrdgasdthawed.exe 30 PID 1424 wrote to memory of 2788 1424 cmd.exe 32 PID 1424 wrote to memory of 2788 1424 cmd.exe 32 PID 1424 wrote to memory of 2788 1424 cmd.exe 32 PID 1424 wrote to memory of 2924 1424 cmd.exe 33 PID 1424 wrote to memory of 2924 1424 cmd.exe 33 PID 1424 wrote to memory of 2924 1424 cmd.exe 33 PID 1424 wrote to memory of 2800 1424 cmd.exe 34 PID 1424 wrote to memory of 2800 1424 cmd.exe 34 PID 1424 wrote to memory of 2800 1424 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\mrdgasdthawed.exe"C:\Users\Admin\AppData\Local\Temp\mrdgasdthawed.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\52fUP71gMD.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2788
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2924
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171B
MD598e1c3004153ced5ac7c39a0d7c1afb5
SHA1fe6b66b5516bf937061ed8134dfac74c8c2b5b5c
SHA256ee4298c8574a33bb89b766e7dade39575f4a42855789b497d025296b8dedc649
SHA512086d21aada958b9e73d29d7a2242ce7e5552d63c9c6c7d0fa3fef54ea9ffc69c226e64b0387c27c44d2241f0b29ba7e28c719238bc00a94f77f6ac9850082284
-
Filesize
560KB
MD537cb065f052d8cf6a46d41d6225b9a9f
SHA1ffcd01452c4b695f1371787a5c728c692283fca2
SHA2560b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01
SHA5128a2850f61af22a40ebb1e11c1d294cd74c94cf3b365619a4588bfbc54362575467cff4a5d75f685354b073453ad9892125739e78468a8dc550e52ccab88df47e