Analysis

  • max time kernel
    119s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2024 15:48

General

  • Target

    mrdgasdthawed.exe

  • Size

    560KB

  • MD5

    37cb065f052d8cf6a46d41d6225b9a9f

  • SHA1

    ffcd01452c4b695f1371787a5c728c692283fca2

  • SHA256

    0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01

  • SHA512

    8a2850f61af22a40ebb1e11c1d294cd74c94cf3b365619a4588bfbc54362575467cff4a5d75f685354b073453ad9892125739e78468a8dc550e52ccab88df47e

  • SSDEEP

    6144:s/9Sb1sKhV/+NZCwUW/mulaEqLhEWRzSyAZW9z9mXbj7Gvvai33Ew8X6Asz6UrZ:sFK1DH/p8l/zWRdP5mfA33EjKf6UrZ

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • DCRat payload 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mrdgasdthawed.exe
    "C:\Users\Admin\AppData\Local\Temp\mrdgasdthawed.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\52fUP71gMD.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1424
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2788
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2924
        • C:\Users\Admin\AppData\Local\staticfile.exe
          "C:\Users\Admin\AppData\Local\staticfile.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2800

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\52fUP71gMD.bat

      Filesize

      171B

      MD5

      98e1c3004153ced5ac7c39a0d7c1afb5

      SHA1

      fe6b66b5516bf937061ed8134dfac74c8c2b5b5c

      SHA256

      ee4298c8574a33bb89b766e7dade39575f4a42855789b497d025296b8dedc649

      SHA512

      086d21aada958b9e73d29d7a2242ce7e5552d63c9c6c7d0fa3fef54ea9ffc69c226e64b0387c27c44d2241f0b29ba7e28c719238bc00a94f77f6ac9850082284

    • C:\Users\Admin\AppData\Local\staticfile.exe

      Filesize

      560KB

      MD5

      37cb065f052d8cf6a46d41d6225b9a9f

      SHA1

      ffcd01452c4b695f1371787a5c728c692283fca2

      SHA256

      0b3af32b322e30f7f68017c13e59e71b6b1f26756477e122b40a20434bd01d01

      SHA512

      8a2850f61af22a40ebb1e11c1d294cd74c94cf3b365619a4588bfbc54362575467cff4a5d75f685354b073453ad9892125739e78468a8dc550e52ccab88df47e

    • memory/2156-0-0x000007FEF5B43000-0x000007FEF5B44000-memory.dmp

      Filesize

      4KB

    • memory/2156-1-0x00000000000E0000-0x0000000000172000-memory.dmp

      Filesize

      584KB

    • memory/2156-2-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

      Filesize

      9.9MB

    • memory/2156-3-0x0000000000200000-0x000000000020E000-memory.dmp

      Filesize

      56KB

    • memory/2156-4-0x0000000000210000-0x000000000021C000-memory.dmp

      Filesize

      48KB

    • memory/2156-11-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

      Filesize

      9.9MB

    • memory/2800-15-0x00000000012B0000-0x0000000001342000-memory.dmp

      Filesize

      584KB