Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 02:01

General

  • Target

    04069d6dc8c9b79d04e96c9cd2950a374abe0c2604110c27227f60a851da123d.exe

  • Size

    25.5MB

  • MD5

    b9c8dee5e0470b21d27b1a70afe25495

  • SHA1

    955aebc905591be2c45fb95ac689374552455b58

  • SHA256

    04069d6dc8c9b79d04e96c9cd2950a374abe0c2604110c27227f60a851da123d

  • SHA512

    995ea49bdcba082927264e6dca3ac5d45ad8e152a3c9d71b9f63881e10537f866b5f45e1634af5bc1c44fb36fb0ec48b1a0ece866e1f58d14c2dcc46a0c88cf7

  • SSDEEP

    98304:vS4Lhcl+62txet6kccrV00zSO76bgkVB:vS4yA62txY1cc0XOubtVB

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04069d6dc8c9b79d04e96c9cd2950a374abe0c2604110c27227f60a851da123d.exe
    "C:\Users\Admin\AppData\Local\Temp\04069d6dc8c9b79d04e96c9cd2950a374abe0c2604110c27227f60a851da123d.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hX99Ylzo3q.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1460
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2584
        • C:\Users\Public\Registry.exe
          "C:\Users\Public\Registry.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:3508

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\WindowsRE\04069d6dc8c9b79d04e96c9cd2950a374abe0c2604110c27227f60a851da123d.exe

      Filesize

      25.5MB

      MD5

      b9c8dee5e0470b21d27b1a70afe25495

      SHA1

      955aebc905591be2c45fb95ac689374552455b58

      SHA256

      04069d6dc8c9b79d04e96c9cd2950a374abe0c2604110c27227f60a851da123d

      SHA512

      995ea49bdcba082927264e6dca3ac5d45ad8e152a3c9d71b9f63881e10537f866b5f45e1634af5bc1c44fb36fb0ec48b1a0ece866e1f58d14c2dcc46a0c88cf7

    • C:\Users\Admin\AppData\Local\Temp\hX99Ylzo3q.bat

      Filesize

      156B

      MD5

      4157dce14887482025ca615c50f5e3f2

      SHA1

      eb88d1cefaca60a43c95d509b7ae9f8ff4815073

      SHA256

      554421febfade6abc7f60dcfc5b921758fca8cf2ca882f4d6c98cfe8840200a0

      SHA512

      22b309fa7a348dd257973c9b1d24eec92f3a8bcc05144da8313be5cb72e4b7cc1d609ba6d53ad52760ff71a3c9de59198aa627b06074e0b693d7cb8f8100db76

    • memory/3456-28-0x000000001BEE0000-0x000000001BEF0000-memory.dmp

      Filesize

      64KB

    • memory/3456-55-0x000000001D0B0000-0x000000001D0BC000-memory.dmp

      Filesize

      48KB

    • memory/3456-4-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-7-0x0000000003050000-0x000000000305E000-memory.dmp

      Filesize

      56KB

    • memory/3456-6-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-8-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-9-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-11-0x000000001BB70000-0x000000001BB8C000-memory.dmp

      Filesize

      112KB

    • memory/3456-12-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-13-0x000000001BEF0000-0x000000001BF40000-memory.dmp

      Filesize

      320KB

    • memory/3456-15-0x0000000003060000-0x0000000003070000-memory.dmp

      Filesize

      64KB

    • memory/3456-16-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-18-0x000000001BEC0000-0x000000001BED8000-memory.dmp

      Filesize

      96KB

    • memory/3456-33-0x000000001D050000-0x000000001D062000-memory.dmp

      Filesize

      72KB

    • memory/3456-22-0x000000001BEA0000-0x000000001BEB0000-memory.dmp

      Filesize

      64KB

    • memory/3456-24-0x000000001BEB0000-0x000000001BEBE000-memory.dmp

      Filesize

      56KB

    • memory/3456-26-0x000000001D010000-0x000000001D022000-memory.dmp

      Filesize

      72KB

    • memory/3456-29-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-74-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-3-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-20-0x0000000003070000-0x0000000003080000-memory.dmp

      Filesize

      64KB

    • memory/3456-37-0x000000001CFF0000-0x000000001CFFE000-memory.dmp

      Filesize

      56KB

    • memory/3456-39-0x000000001D000000-0x000000001D010000-memory.dmp

      Filesize

      64KB

    • memory/3456-35-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-41-0x000000001D070000-0x000000001D080000-memory.dmp

      Filesize

      64KB

    • memory/3456-43-0x000000001D0E0000-0x000000001D13A000-memory.dmp

      Filesize

      360KB

    • memory/3456-34-0x000000001D5A0000-0x000000001DAC8000-memory.dmp

      Filesize

      5.2MB

    • memory/3456-45-0x000000001D080000-0x000000001D08E000-memory.dmp

      Filesize

      56KB

    • memory/3456-47-0x000000001D090000-0x000000001D0A0000-memory.dmp

      Filesize

      64KB

    • memory/3456-50-0x000000001D0A0000-0x000000001D0AE000-memory.dmp

      Filesize

      56KB

    • memory/3456-52-0x000000001D140000-0x000000001D158000-memory.dmp

      Filesize

      96KB

    • memory/3456-53-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-48-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-31-0x000000001D030000-0x000000001D046000-memory.dmp

      Filesize

      88KB

    • memory/3456-2-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

      Filesize

      10.8MB

    • memory/3456-72-0x000000001D360000-0x000000001D409000-memory.dmp

      Filesize

      676KB

    • memory/3456-1-0x0000000000B30000-0x0000000000E3A000-memory.dmp

      Filesize

      3.0MB

    • memory/3456-0-0x00007FFEC95C3000-0x00007FFEC95C5000-memory.dmp

      Filesize

      8KB

    • memory/3508-98-0x000000001D360000-0x000000001D409000-memory.dmp

      Filesize

      676KB