Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2024 02:06

General

  • Target

    69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe

  • Size

    828KB

  • MD5

    c6b30f794dcf67851d13e3335ef57088

  • SHA1

    e97b575fc270d97d1e2df38291fd44dc70ff95ab

  • SHA256

    69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7

  • SHA512

    28dc37c57408fa9e6e3a14a99d602e6c0f937e259f21eefd016424d03d40066e6b518c9b0bcbae8039c1691ce43ba8803c568ad69df163938e4ff2235c55188b

  • SSDEEP

    12288:K5jHYVjmobNqsKDsSvjbHQVtVZJizDxRxhDsGALvbI6bnY6a2Xuk:1b4sKDZUZJuR/ALvbLnY8Xuk

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe
    "C:\Users\Admin\AppData\Local\Temp\69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CyxGcg3L6d.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1728
        • C:\Program Files\Windows Sidebar\ja-JP\wininit.exe
          "C:\Program Files\Windows Sidebar\ja-JP\wininit.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2912
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\ja-JP\wininit.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2900
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\ja-JP\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1164
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\ja-JP\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1956
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteApps\smss.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2800
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2828
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\RemotePackages\RemoteApps\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2760
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\PLA\System\smss.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2976
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\PLA\System\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2332
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\PLA\System\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2824
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\System.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2776
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2768
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2604
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\smss.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2636
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Migration\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1976
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2272

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\CyxGcg3L6d.bat

      Filesize

      215B

      MD5

      6efc3e111bdabdc6c2fd4d696fd2458a

      SHA1

      7ba1e3c7b2265c3deb0f865c2a50e01f4ede08a5

      SHA256

      41182c86e044ae7ecc0bae97b214ba96661f473c0468852bd44c72c4c869a617

      SHA512

      aea032b99602f34656511e2783e88dc5dd0482bee278f647bf670fc1dedae367873b5c25f2a8795d6e3275a1ccd2d379a0f2ce9b1a75cd901f77296bc61d713d

    • C:\Windows\Migration\smss.exe

      Filesize

      828KB

      MD5

      c6b30f794dcf67851d13e3335ef57088

      SHA1

      e97b575fc270d97d1e2df38291fd44dc70ff95ab

      SHA256

      69ff8a0bc37e646c87c138131da225d134464a806fea55d265ee5813756340d7

      SHA512

      28dc37c57408fa9e6e3a14a99d602e6c0f937e259f21eefd016424d03d40066e6b518c9b0bcbae8039c1691ce43ba8803c568ad69df163938e4ff2235c55188b

    • memory/1992-0-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

      Filesize

      4KB

    • memory/1992-1-0x0000000000F90000-0x0000000001066000-memory.dmp

      Filesize

      856KB

    • memory/1992-2-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

      Filesize

      9.9MB

    • memory/1992-17-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

      Filesize

      9.9MB

    • memory/2912-21-0x0000000001220000-0x00000000012F6000-memory.dmp

      Filesize

      856KB