Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-12-2024 23:14
General
-
Target
cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07.exe
-
Size
682KB
-
MD5
e5e4996e98303646d51296cd1a292e8d
-
SHA1
d023ebe75fb01aa822f3788765be68108b3197df
-
SHA256
cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07
-
SHA512
57f5299aeefa22032c9e7df3d1c39d1a33504c1ec1ea5c80bf7fbf8b78042b9bfcae81155fcbfed24e7b9a603b960b2285872765b4c2dbed1bda6aa8e3db4ca3
-
SSDEEP
12288:hqnO3mwJNoGFAgHCRvp1i/fjqJRYFInDrX/xTU3JgXDV6blx1wgtra7B+:h+O3mwJnCRvEMxnDVSwgYc
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 6 IoCs
-
DCRat payload 5 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Drops file in System32 directory 5 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07.exe"C:\Users\Admin\AppData\Local\Temp\cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\Kno5025\cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07.exe"C:\Users\Admin\AppData\Local\Temp\Kno5025\cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\Kno5025\cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\wmsetup\cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\System32\hr-HR\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
682KB
MD5becd8205763ebc639078fc7615e3355f
SHA106173a69ca345a33fa9a93540250be604554c354
SHA25665d9a237528cbd6698a15cfb05411f07207b17ea133dfff132d487f4dedfb694
SHA51267b32d4eec07fab000d544d0d12c0455e0054b5f4448de46db186d113841c5e84b7d531c75c2e4542a2fbc6135e7137c8e905110a38196ed863772f7c544509d
-
Filesize
682KB
MD5e5e4996e98303646d51296cd1a292e8d
SHA1d023ebe75fb01aa822f3788765be68108b3197df
SHA256cacc2bcd375c4f4705b4b445eef937f7534600d7e39bc8d497e6b36a2f0c6a07
SHA51257f5299aeefa22032c9e7df3d1c39d1a33504c1ec1ea5c80bf7fbf8b78042b9bfcae81155fcbfed24e7b9a603b960b2285872765b4c2dbed1bda6aa8e3db4ca3
-
Filesize
682KB
MD5fdd7f11c7522650208837ccddb359f72
SHA1b0938e1567d95eaec53370d245d6f108ceaaf260
SHA256a869f04c2ee91e5aac0528fad920de392bc78f494a980ac6682d7c3b442a04f7
SHA5120317f97e314b1d3c2b6ac9ffac5e7649b48f440752296a55c81c2d34d758e049e37416ee8da8e42e22900899b8b4f021fae89efcc8623edfcea4f1d81429c31d
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
712KB
-
Filesize
9.9MB
-
Filesize
712KB