Analysis
-
max time kernel
0s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 07:28
General
-
Target
7bdc4a94cc023cd96272ecd3d7294d01b121fce48c0a80725368c95df1a14dcb.exe
-
Size
783KB
-
MD5
a01ba8b94da113abb830119dad3cfc17
-
SHA1
4ccd1d3ce62f864071afdc842f9f9e4b2a4ee0a7
-
SHA256
7bdc4a94cc023cd96272ecd3d7294d01b121fce48c0a80725368c95df1a14dcb
-
SHA512
35a7f30941ead4d6de05bf59193624c287ab97dc24607fb229621bbc0a3aac4102ef94dac84c2b3a088276001430c14d925e085ca788657fb81967ed7b67fe3d
-
SSDEEP
12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK4:G+OQbpbgsFdAyQvzSqaq8qB
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
UAC bypass 3 TTPs 3 IoCs
-
DCRat payload 6 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in System32 directory 6 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bdc4a94cc023cd96272ecd3d7294d01b121fce48c0a80725368c95df1a14dcb.exe"C:\Users\Admin\AppData\Local\Temp\7bdc4a94cc023cd96272ecd3d7294d01b121fce48c0a80725368c95df1a14dcb.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hsxZ7AtwBz.bat"2⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Windows\System32\qcap\dwm.exe"C:\Windows\System32\qcap\dwm.exe"3⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\qcap\dwm.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\CIRCoInst\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\lsasetup\explorer.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\rtmmvrortc\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\internetmail\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\twain_32\sysmon.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196B
MD5907cf7df10b04f3f61d4e96939f8f116
SHA13e124bb54165f8c21b069f18e1b025b1d024ef21
SHA25642185fbd4e13f1c0b78199459838296c0b31a753e447e63ce84587b6e145de0a
SHA5121e29b8e96f07e866cca4bacd57084669ac1126dcbedfb2026aafa388aaffe87dbff1e84259bb82065b70454838e2f167069df63ba433e01c5e570fb566cb88b9
-
Filesize
783KB
MD54383aeb7a3482e7a8dd5e6bb8a0dd9ff
SHA1eea3bd83c71cf729764ff0f6eee751f761c4c79d
SHA25653dd03c36c1a8635163bc915b37c2e4b9fa67e1e877fcf38fe268deff0e24faa
SHA5121727d1cf9457b751eebbee0ecab126410e136673c4e0dbe85819a3daeefec9bf5e05b215960a4d58dadca692f5ae5a34078149a03ce213037026e99dece981c8
-
Filesize
783KB
MD5a01ba8b94da113abb830119dad3cfc17
SHA14ccd1d3ce62f864071afdc842f9f9e4b2a4ee0a7
SHA2567bdc4a94cc023cd96272ecd3d7294d01b121fce48c0a80725368c95df1a14dcb
SHA51235a7f30941ead4d6de05bf59193624c287ab97dc24607fb229621bbc0a3aac4102ef94dac84c2b3a088276001430c14d925e085ca788657fb81967ed7b67fe3d
-
Filesize
783KB
MD56cb8d50e4dd746731d97972e8772e0d0
SHA1d38429f683fb540c044e51e1a11a7d16cc16434f
SHA256ee7d5e44c38ccd50a44612e4642bf6ea9b537f28aa71983756d3af28475006c8
SHA512351da69f81a4f346f430a2832c5c18658627beaa72d16d33b4f3867161526d3049310071d85c8e3011d373ce0c9422aff7791a44a7a767ff14a50dcb3c5e5f37
-
Filesize
783KB
MD5efd24089c825c314364efac40a5ba632
SHA1df9acc3f255d6072bc01a01e1dd71153194c98a7
SHA256d54addb370e232830efe1d8b4467ffc99fc736719e0f924440a1036b3cd81bfb
SHA512501f38af58f6c9a57ebf267aaad6143f2b77309ed74576fc9739af7bbb8610869a27fa417dfcf364d21d3a92d47ae41ba0e1d04106774db093305d134362584e
-
Filesize
808KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
808KB