Overview

overview

10

Static

static

10

7a735fb7f6...ed.exe

windows7-x64

10

7a735fb7f6...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2024 18:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a735fb7f6e21b8f02009613d40272571de48bb6511509326e65f44aec6b19ed.exe

  • Size

    952KB

  • MD5

    74ffc0f02c115af7ca2a9e63280ee91a

  • SHA1

    cbc921ebe0671922b3495aead9c23c9d8305baba

  • SHA256

    7a735fb7f6e21b8f02009613d40272571de48bb6511509326e65f44aec6b19ed

  • SHA512

    e9a2453c1a3c897a94a0cb817c12dbda52c175a709704614cda8497ce95dd6f137d394d3e6c0136f73819b05c1248649b4a1fc147c90dbe0bdc25d12b1fa5179

  • SSDEEP

    24576:e+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXXX:Z8/KfRTKt

Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 9 IoCs
    persistence
  • Process spawned unexpected child process 8 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 9 IoCs
    evasiontrojan
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 9 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a735fb7f6e21b8f02009613d40272571de48bb6511509326e65f44aec6b19ed.exe
    "C:\Users\Admin\AppData\Local\Temp\7a735fb7f6e21b8f02009613d40272571de48bb6511509326e65f44aec6b19ed.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1708
    • C:\Users\Admin\AppData\Local\Temp\7a735fb7f6e21b8f02009613d40272571de48bb6511509326e65f44aec6b19ed.exe
      "C:\Users\Admin\AppData\Local\Temp\7a735fb7f6e21b8f02009613d40272571de48bb6511509326e65f44aec6b19ed.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4160
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2u3eJEabOe.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3360
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          4⤵
            PID:3704
          • C:\ProgramData\Microsoft OneDrive\setup\RuntimeBroker.exe
            "C:\ProgramData\Microsoft OneDrive\setup\RuntimeBroker.exe"
            4⤵
            • UAC bypass
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of AdjustPrivilegeToken
            • System policy modification
            PID:228
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4892
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\PerfLogs\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4292
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\wslapi\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1064
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\C_874\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4544
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\setup\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3528
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\fwcfg\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3588
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\pnpclean\fontdrvhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3284
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3328
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4624

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Impair Defenses

    1
    T1562

    Disable or Modify Tools

    1
    T1562.001

    Modify Registry

    4
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\WindowsRE\RuntimeBroker.exe
      Filesize

      952KB

      MD5

      ddf452c6e551b6307aaeac75a619f4cc

      SHA1

      60aac8da3c84271e35fed18dcf6d74380ebad424

      SHA256

      e7d1c6356bd56f2523755911ba1f0008962d0a0840d1b25d792d1b8e0d99e201

      SHA512

      c6a3a868fd8bba06727e9ed5a85386c22a841e7e3ee2f95f24b3b7c32a6662b99daea19ec0cc2374c7c6fe16c94c24fa93c33a4afb450e8e1cb82433a76c95fc

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\7a735fb7f6e21b8f02009613d40272571de48bb6511509326e65f44aec6b19ed.exe.log
      Filesize

      1KB

      MD5

      7f3c0ae41f0d9ae10a8985a2c327b8fb

      SHA1

      d58622bf6b5071beacf3b35bb505bde2000983e3

      SHA256

      519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

      SHA512

      8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\2u3eJEabOe.bat
      Filesize

      221B

      MD5

      7235345234e933b231bfb6230070fefe

      SHA1

      70365c60c2ccdada5df983d76136acedbea796e0

      SHA256

      d4871b2dee441982f55bb6a03ced63d12f97eacc589b326906080abddb188a0d

      SHA512

      4cdc002bb9b0d0a951977b6ffe9d120a8bc0b0320d786c8cb22ba55b702b0603741e7d05b83a78a5f938ba408beb74ef16b2a68032453ebbe9eed7271fc74db9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7a735fb7f6e21b8f02009613d40272571de48bb6511509326e65f44aec6b19ed.exe
      Filesize

      952KB

      MD5

      74ffc0f02c115af7ca2a9e63280ee91a

      SHA1

      cbc921ebe0671922b3495aead9c23c9d8305baba

      SHA256

      7a735fb7f6e21b8f02009613d40272571de48bb6511509326e65f44aec6b19ed

      SHA512

      e9a2453c1a3c897a94a0cb817c12dbda52c175a709704614cda8497ce95dd6f137d394d3e6c0136f73819b05c1248649b4a1fc147c90dbe0bdc25d12b1fa5179

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\RCX9AD9.tmp
      Filesize

      952KB

      MD5

      8e6e52fa1da6893e7bee069c7e5dacd0

      SHA1

      e05854289cc5bb1c60c39fd5453b720cf79eabad

      SHA256

      27e67aaa049c2243423f3c2c33e7747033f63234eda122bc9beaad90528cfd0d

      SHA512

      19ca97f006c3a34bc16f6d0538b3ef3d40ebc80c4b2a7019c91ffe989250f8109e337af2c808aa4010c72334d2afd6883f247f573b5b33b5b4d019e234d881b9

      Download Submit

    • memory/1708-8-0x0000000001BC0000-0x0000000001BC8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1708-10-0x000000001BB10000-0x000000001BB1C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1708-9-0x000000001BAF0000-0x000000001BAFA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1708-11-0x000000001BC30000-0x000000001BC3C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1708-7-0x000000001BAE0000-0x000000001BAEA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1708-5-0x0000000001BE0000-0x0000000001BEA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1708-4-0x0000000001B90000-0x0000000001BA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1708-3-0x0000000001B80000-0x0000000001B90000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1708-0-0x00007FF814CB3000-0x00007FF814CB5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1708-6-0x000000001BB00000-0x000000001BB0C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1708-75-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1708-2-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1708-1-0x0000000000E40000-0x0000000000F34000-memory.dmp

      Filesize

      976KB

      Download