Overview

overview

10

Static

static

3

aa7a05956c...a9.exe

windows7-x64

10

aa7a05956c...a9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2024 02:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9.exe

  • Size

    2.7MB

  • MD5

    8b744166eecace320158f4d0f704b13e

  • SHA1

    b92636084b3bd914514bc44556c4803933d667a3

  • SHA256

    aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9

  • SHA512

    641b3065e30186ccf9ba84ce6d345565763bbdb5fc1b1201c3f08fce5466c2384250b85b4c0220d2b9e21c5a51ff5ef60e9b910e07107e2b7e06f97b4e429d27

  • SSDEEP

    24576:l+O4GuNVHU+AH2FWxOYIOlIZBrlsQBYI63DSyve5fG:s3N5IO6OtsMYIxS

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Signatures

  • DcRat 43 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 13 IoCs
    persistence
  • Process spawned unexpected child process 13 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 26 IoCs
    persistence
  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9.exe
    "C:\Users\Admin\AppData\Local\Temp\aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Users\Admin\AppData\Local\Temp\aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9.exe
      "C:\Users\Admin\AppData\Local\Temp\aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9.exe"
      2⤵
      • DcRat
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IoomRerVO2.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          4⤵
            PID:3068
          • C:\Users\Admin\AppData\Local\Temp\aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9.exe
            "C:\Users\Admin\AppData\Local\Temp\aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Checks computer location settings
            • Adds Run key to start application
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1568
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uqUx6UrUG7.bat"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1064
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                6⤵
                  PID:4004
                • C:\Recovery\WindowsRE\sihost.exe
                  "C:\Recovery\WindowsRE\sihost.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1164
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4764
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4800
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\spoolsv.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:948
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\NetworkCollectionAgent\lsass.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4708
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\ProximityRtapiPal\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4316
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2716
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140\OfficeClickToRun.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1092
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\winlogon.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3696
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\ieui\taskhostw.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4992
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\iuilp\sihost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5004
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4656
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2216
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\wsp_fs_uninstall\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3516

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9.exe.log
        Filesize

        1KB

        MD5

        b7c0c43fc7804baaa7dc87152cdc9554

        SHA1

        1bab62bd56af745678d4e967d91e1ccfdeed4038

        SHA256

        46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457

        SHA512

        9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\IoomRerVO2.bat
        Filesize

        266B

        MD5

        4e35461ff48ba76a7eb2ff8ba7e38175

        SHA1

        fa9a2c382c7b9463da3165beef074eb24704cf2b

        SHA256

        c3c5a90c0cb1e276fc8a06623cf51dbee4219ee5a0868e1a6d9f015c211ed6ac

        SHA512

        9d77f5d5ebc8a7fdcc5bcb06edc4453fd42eefe6b24f4c34514643e0db6611bca434acb38ee58a16a9c3c82e28ab2e4612f8bdac19326f1a797140052436dabf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\uqUx6UrUG7.bat
        Filesize

        196B

        MD5

        631b0e9773047e9cbbce419e15aad153

        SHA1

        4a7298b0e1dab5c76bf11e2c31969a9a66302191

        SHA256

        73ced6a5ccb581396b6977eca5150fe9daaacfafc40da6913e8671d1a4fe1622

        SHA512

        a55e82e088f7e53e8876cfc6a22d9e7e74a8cf9c93e5b3eef1be15a4f7b2c70c9b0e648fceda0b642727d8c3aa01fdd93e048192c4431d4d2bd131ba5af3bec1

        Download Submit

      • C:\Windows\System32\ProximityRtapiPal\RuntimeBroker.exe
        Filesize

        2.7MB

        MD5

        8b744166eecace320158f4d0f704b13e

        SHA1

        b92636084b3bd914514bc44556c4803933d667a3

        SHA256

        aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9

        SHA512

        641b3065e30186ccf9ba84ce6d345565763bbdb5fc1b1201c3f08fce5466c2384250b85b4c0220d2b9e21c5a51ff5ef60e9b910e07107e2b7e06f97b4e429d27

        Download Submit

      • memory/1164-45-0x0000000000E10000-0x0000000000E1C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1164-46-0x0000000000E20000-0x0000000000E2C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1164-47-0x0000000000E50000-0x0000000000E5C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1164-48-0x0000000002650000-0x0000000002658000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1164-49-0x0000000000E30000-0x0000000000E3A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4320-4-0x00007FFB28110000-0x00007FFB28BD1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4320-1-0x0000000000F40000-0x00000000011EE000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/4320-13-0x00007FFB28110000-0x00007FFB28BD1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4320-0-0x00007FFB28113000-0x00007FFB28115000-memory.dmp

        Filesize

        8KB

        Download