Analysis
-
max time kernel
24s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/12/2024, 13:30 UTC
General
-
Target
NeverLose Loader.exe
-
Size
2.8MB
-
MD5
a35bacaf176f367bd51ed22782dc5519
-
SHA1
99fdd147469d0392fc2a8fcc714206a70c3961db
-
SHA256
9fc8c881c65e76927632323529b5186fb552d22fa4b52b6ac82165728aa02f9f
-
SHA512
b33b4452cccd762eead94b90244e2aaefa9f5fcca45dba761d5e28a28a2bbc3ef201b2e1f187df6e66949fb501f1edb31f7d9634dfa7dd17bb7050142a31b51a
-
SSDEEP
49152:tBUnRxbHAr0MmN6vm2H0MvnoxhRb4q3WO/PVdxfgz6:n2RxbHyfH0MvnonRbZ5Vd5o6
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NeverLose Loader.exe"C:\Users\Admin\AppData\Local\Temp\NeverLose Loader.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\agentsavesSessioncrt\wvAy3g2cwUA0WlAR67rDwx6ilqeJ3huGsrpLtUKpTSpXZqeLmD5jcZq.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\agentsavesSessioncrt\fqPjTa5dmPVCKdRywzd7JYZCOwyT6TkVbtC1AmfVOodlKWVPvDa.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\agentsavesSessioncrt\hyperBlockServerSavesSession.exe"C:\agentsavesSessioncrt/hyperBlockServerSavesSession.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zklvxjjd\zklvxjjd.cmdline"5⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE733.tmp" "c:\Windows\System32\CSC64A9DA5E912B45C380D89BBEBED6B8C9.TMP"6⤵
-
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\agentsavesSessioncrt\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\agentsavesSessioncrt\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\agentsavesSessioncrt\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS217.106.137.52.in-addr.arpaRemote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
DNS83.210.23.2.in-addr.arpaRemote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS14.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:53217.106.137.52.in-addr.arpadns
DNS Request
217.106.137.52.in-addr.arpa
-
8.8.8.8:5383.210.23.2.in-addr.arpadns
DNS Request
83.210.23.2.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5314.160.190.20.in-addr.arpadns
DNS Request
14.160.190.20.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5616b1ca7043b460eb8509579739269dc
SHA1d373c0154cb2d5811fdc465951b5531c937c9fa2
SHA256c8658d76547b54703bac347d7248674bd16d1c6e9aa3bedceadec9b68f40a9a2
SHA512d71422a2ae3ebdd77190dd26ce2e1d1f31acae87327827cb3e8f9d328bbc900475768ae51e351f7f798f72a6c2d00564b0fc9da8cc70d0290cb0fc9e843c0b95
-
Filesize
103B
MD5ebe4c21126c470353bc85eac1cef774a
SHA1ee65d9ffab4a9d4781feb71d087a946bd64476cb
SHA25627dc735359b7b713506b5a2dbacbbdb43d296f0cc4f11f374b59d605ec4f64e0
SHA51267b2b033fb58cd3df39a1b7741d14729ef092d21c142c0a06611eed6479000ca29595496624b8d2acf43041ef8332e4cb66923d10b9b6a29dc29e9e007885f13
-
Filesize
2.3MB
MD522a0f7e0137b38061bcea6990ea2b3d8
SHA165b9d717a7a53df2bd8c58351510033e771cfd02
SHA256ad7b5a48b29168ac72ab4d887e21021c3c63d4320de8b0b88ae8d295c98a051e
SHA512192acb8169f883ece3af2c83eacef49bc6fa465bbe943b3716af785e8bb4bc959fe7e6457b14bb5474adba6fd5f18fc9e30bf2a1a63b5147d0dca5e52681ae25
-
Filesize
250B
MD5a0513e519e74038b3105c6da2ab0d334
SHA16c5f7f413c19c0f7c2584e706a60d08c27823e36
SHA2563ed9c9074b5448cb4fdc13904739407317f5e083eda10b4ab6145888ffa12033
SHA512222c2107dcfc29a0e0a05a5378ac38a564c175868d9a9428de4610cff53b35c16dee575e4d63eb427ad23bcaec7a8649167b4918aaf18e78bf7329a6c2e3b877
-
Filesize
373B
MD588fac8c11bfa1d3d9760f01a8102a18b
SHA1082b3403249570f33844ebd4ee1836c3b649be1d
SHA25635314d50c7c404da406f186f75740a4c96ce3f2c5ac03ec739dcab8e420151e3
SHA512ea0dcdb390c48d2c7a2e4557ad46e2fae4212c4e46a4d0a7ac4da49ab41209e2ba9906d3f417d269a22bc31dfc2f27ffa9043bb9e664b0303d2afb153b8b212a
-
Filesize
235B
MD525b8e1f70d5c054f5a5450049f0052ad
SHA1998aac474fa791c5a2234fc482309a52028e95ff
SHA2561cf05f8d483aae7d09b83e9eaa6098719ec9b8d9a03311ffe6e4c8fb6124a3eb
SHA5125fdc0e86ebb15c6bd36055a93e3de896c0c21a3e14bcb8a5075a5cf8c2f597d33ff5728d1576eff70eba587313fced6ec462b4dd744f04ea84ff856d5deaad45
-
Filesize
1KB
MD575e32610d8ef6143201c7c28465fcda9
SHA1b2bae99fade2dda07aecbe1659d184be0fc4e7a6
SHA25697ee1cac3965d9cc55a60f20206f384719431f19ac96bdc52b93a98de51a639b
SHA512b303fb99586efd19a08223ba93472fa6d33fcf9198bbf42fb16ba61001db59e5fd5835ea7696ed34e4004d23fa60697e724e6085d1269d788204bf95dfe46abc
-
Filesize
320KB
-
Filesize
360KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
96KB
-
Filesize
112KB
-
Filesize
56KB
-
Filesize
2.3MB