Overview

overview

10

Static

static

3

4b1a5d38d7...9b.exe

windows7-x64

10

4b1a5d38d7...9b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 01:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4b1a5d38d7741fea74f2cf45d5b215955ba9fe117d6f6a0e7ecbef64118c449b.exe
  • Size 2.2MB
  • Sample241230-blpd1sspgs
  • SHA256 4b1a5d38d7741fea74f2cf45d5b215955ba9fe117d6f6a0e7ecbef64118c449b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratdiscoveryexecutioninfostealerratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b1a5d38d7741fea74f2cf45d5b215955ba9fe117d6f6a0e7ecbef64118c449b.exe
    "C:\Users\Admin\AppData\Local\Temp\4b1a5d38d7741fea74f2cf45d5b215955ba9fe117d6f6a0e7ecbef64118c449b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\hyperServerBrowserhostmonitor\GgQkil7dD38i66IF6CgYN1iKH8yPMrkKOsB0R1MTAIce7pdb.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2944
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Roaming\hyperServerBrowserhostmonitor\PniGsaMva0WDN2bCUuIn757jtMvPYPCKlQoP3qJ.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2380
        • C:\Users\Admin\AppData\Roaming\hyperServerBrowserhostmonitor\HyperPortContainerproviderinto.exe
          "C:\Users\Admin\AppData\Roaming\hyperServerBrowserhostmonitor/HyperPortContainerproviderinto.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2540
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2904
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2912
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2960
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2636
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2640
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2428
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2920
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2660
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2896
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1644
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2628
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2676
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Reports\fr-FR\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2444
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\it-IT\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2152
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2456
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2784
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\hyperServerBrowserhostmonitor\HyperPortContainerproviderinto.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2188
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9JGK8Rhy5M.bat"
            5⤵
              PID:2712
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:2448
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1612
                • C:\Users\Default User\services.exe
                  "C:\Users\Default User\services.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2680

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            9JGK8Rhy5M.bat
            • Path C:\Users\Admin\AppData\Local\Temp\9JGK8Rhy5M.bat
            • Size 162B
            • SHA256 7b75dd621ce934175fcc2469a11f4dc8db88cd322a30815f578139f6693345ce
            • MD5 SHA1 SHA512
            Submit Download

            590aee7bdd69b59b.customDestinations-ms
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            • Size 7KB
            • SHA256 90e3bab54e2d1e2cdd66c7f8fce05384e210f5bd94818769a2f7152f2866ae42
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GgQkil7dD38i66IF6CgYN1iKH8yPMrkKOsB0R1MTAIce7pdb.vbe
            • Path C:\Users\Admin\AppData\Roaming\hyperServerBrowserhostmonitor\GgQkil7dD38i66IF6CgYN1iKH8yPMrkKOsB0R1MTAIce7pdb.vbe
            • Size 250B
            • SHA256 26572387d0a9326f703f2465d689ef201a6f794184bbb59197484e69fa62d49d
            • MD5 SHA1 SHA512
            Submit Download

            HyperPortContainerproviderinto.exe
            • Path C:\Users\Admin\AppData\Roaming\hyperServerBrowserhostmonitor\HyperPortContainerproviderinto.exe
            • Size 1.9MB
            • SHA256 48dd9601f2067474fa2cb66fe39798b6fe5ab41a51104e2a40247e473b082c2b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PniGsaMva0WDN2bCUuIn757jtMvPYPCKlQoP3qJ.bat
            • Path C:\Users\Admin\AppData\Roaming\hyperServerBrowserhostmonitor\PniGsaMva0WDN2bCUuIn757jtMvPYPCKlQoP3qJ.bat
            • Size 126B
            • SHA256 11407a3eff987eb89a4fc8ca6aaa5c7a92b1a3959e3adf29da6cfd9aa2684298
            • MD5 SHA1 SHA512
            Submit Download

            memory/2540-19-0x0000000000460000-0x0000000000478000-memory.dmp
            Download

            memory/2540-17-0x0000000000430000-0x000000000044C000-memory.dmp
            Download

            memory/2540-21-0x0000000000410000-0x000000000041E000-memory.dmp
            Download

            memory/2540-23-0x0000000000420000-0x000000000042E000-memory.dmp
            Download

            memory/2540-25-0x0000000000480000-0x000000000048C000-memory.dmp
            Download

            memory/2540-15-0x0000000000280000-0x000000000028E000-memory.dmp
            Download

            memory/2540-13-0x0000000000AD0000-0x0000000000CC0000-memory.dmp
            Download

            memory/2640-50-0x000000001B5E0000-0x000000001B8C2000-memory.dmp
            Download

            memory/2680-135-0x00000000011C0000-0x00000000013B0000-memory.dmp
            Download

            memory/2784-66-0x0000000001F40000-0x0000000001F48000-memory.dmp
            Download