Analysis
-
max time kernel
95s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-12-2024 05:34
General
-
Target
ee66bca1ea767e827dfafd301d994e9afd36ff0fae546ad51e18347e999e9529N.exe
-
Size
1.2MB
-
MD5
bb7e3c97bc9136dd95203ac7b480b230
-
SHA1
55af32d959f455d87aec058789c35471272a34f2
-
SHA256
ee66bca1ea767e827dfafd301d994e9afd36ff0fae546ad51e18347e999e9529
-
SHA512
7cfe9fc9e23247ffd1f6d0fb7588af62c01f714d843e2268dab1442af2471e22559d1e41878bdcfb6796d6e572eda982c887160d20015a96e7c3a9c87ad1d77b
-
SSDEEP
24576:m5/FWj01uCUyGXFgSTq/kbe58fWj+1Ya:k/FG0Cpt4i28fWj+1Y
Malware Config
Signatures
-
DcRat 11 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 11 IoCs
-
Process spawned unexpected child process 11 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload 9 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 22 IoCs
-
Drops file in Program Files directory 20 IoCs
-
Drops file in Windows directory 25 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee66bca1ea767e827dfafd301d994e9afd36ff0fae546ad51e18347e999e9529N.exe"C:\Users\Admin\AppData\Local\Temp\ee66bca1ea767e827dfafd301d994e9afd36ff0fae546ad51e18347e999e9529N.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\StartMenuExperienceHost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Documents and Settings\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputCommon\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\resources\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\splwow64\sysmon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\ja-JP\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD530b8a07143397d3ae6462e7c426d53a4
SHA177ab9b6f70e6eed5c2606b202c97b45693ed9761
SHA256cd829fefdbc5ba5bc9407ec57b87c6b9324d29205a62f452c63d928d5534c047
SHA51242802da2d86110d0b5c68b4a3e9fefad88ccfd424d574b27d8f675c97ccdf3ad5192ba742f7b143dedce2ce9a0c207dbd72ad200d254dd34b0a7054adef6fe8e
-
Filesize
1.2MB
MD508c9097b4e9c88639dbe91e02bcff9c6
SHA12d779e8492970ef1703fab70cf882b41a6773b99
SHA256da1f7dfc0f5575fc5778239b0c0f514ba74b9f3a760bd82c965a11d2f233ad69
SHA512395d05c396777f931a8fe5cdd4fa4c48d8ed0a79a1765cbc3b6d64e08675e7889b4c3a7a28631b102aa0c15cce2735d1902e10b729fcdf36382bb72babebd4b1
-
Filesize
1.2MB
MD545906257d87979fa7704cf1a735ffa6f
SHA1bdbdbad8295fa13039d88b6d0073b526ae519c6f
SHA256e80cc9e10e6296967bc2c33bd7600a8e913f8bd2e2fef3da3ebe8b7be9250de5
SHA51225b95d9d782d927fc5c0bb4eefa1e1b870aba76827475d79eb12c5c10fd4d66852f5582ff9055a526dc47acdf77c4fccf9d5e8121565fc6e2ec14be1783afe1a
-
Filesize
1.2MB
MD5ea6a90170126fb29fe9b4cebcd6ce816
SHA1dc97641a9573a856c6816bb049ecf3522c3f22aa
SHA256890a5dd6de4f9e60ddf22af2b9b2a2f1b053c4f7ac39138e320d6d10ea72188b
SHA512e07979341b9ea1a88dca86887fe1f3471cfdbc08bab90eecfc9301273f9b44bcc321c86d3c6b7f334c10ff3c5697e437a4958a4ab0586b53ebef265736a55004
-
Filesize
1.2MB
MD506a419242cde08dd3aa09cf165e7baea
SHA1340bef938e9694f911710ebef549e8f3e9874941
SHA25664b04f7c39b8a4acdee0bd57e50ddba8df874f2d85165302c385e072b4491764
SHA5124a50385666fd04ef7a04a1fedd1c5fd1319a13c95f029142dd2f72811e60059743ba6fe03a7aa5fddb48951f2b0351e12dfb8c41f8b67748018d0f223664686a
-
Filesize
1.2MB
MD5bb7e3c97bc9136dd95203ac7b480b230
SHA155af32d959f455d87aec058789c35471272a34f2
SHA256ee66bca1ea767e827dfafd301d994e9afd36ff0fae546ad51e18347e999e9529
SHA5127cfe9fc9e23247ffd1f6d0fb7588af62c01f714d843e2268dab1442af2471e22559d1e41878bdcfb6796d6e572eda982c887160d20015a96e7c3a9c87ad1d77b
-
Filesize
1.2MB
MD556bd95289d84f9496f9be55278546e40
SHA15214f66bdb74c5fa8a47e2e441ef3570901057f0
SHA2565e28ab5fa7780be06d52b3fce1e1f761cdaef12d2d11c18f560d5c9d5789faf5
SHA512d69e713348ca529223cbfe7bccec865af36b82cc19d44dd5dc0058647856e49b363614cf1f6ba4b71d542ac7d262c988777523c0328eb0e299076ab5a299bbb3
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
1.3MB
-
Filesize
10.8MB
-
Filesize
1.3MB