Overview

overview

10

Static

static

3

4E9DDBFBEB...CB.exe

windows7-x64

10

4E9DDBFBEB...CB.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-01-2025 17:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4E9DDBFBEB41BD97825E0F79426307CB.exe

  • Size

    2.1MB

  • MD5

    4e9ddbfbeb41bd97825e0f79426307cb

  • SHA1

    f7c1150945e4d9ac8f86b0e0c5ee5f2441e1983b

  • SHA256

    f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987

  • SHA512

    b73e5343ef1c7f662e8c134db76a639228eb2ef7e3d3c78648a1b329986243c5d1e43c57541e4f5392dfc44bf967942f093b511cb3dff7390f352168635e2dca

  • SSDEEP

    24576:2TbBv5rUyXVIHaYHemPiKIUdWp9NZAXY000Ub/TdvsXhhbtRtAC+IEZ9rSyzPXcE:IBJwJRIfpxAXalU7tPA3IEHHPo25fNJ

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4E9DDBFBEB41BD97825E0F79426307CB.exe
    "C:\Users\Admin\AppData\Local\Temp\4E9DDBFBEB41BD97825E0F79426307CB.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\winRefruntime\T8Mz9n0cgvFWE.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\winRefruntime\MsAgentDriverruntime.exe
          "C:\winRefruntime/MsAgentDriverruntime.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kx6lgrlYIp.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2660
            • C:\Windows\system32\chcp.com
              chcp 65001
              6⤵
                PID:2612
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                6⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2196
              • C:\winRefruntime\MsAgentDriverruntime.exe
                "C:\winRefruntime\MsAgentDriverruntime.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:2620

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Kx6lgrlYIp.bat
      Filesize

      169B

      MD5

      71d7fd928ebc40ecef4bf3a3fe18ee55

      SHA1

      a7b93f51685fd1ccccb1a7686bcf79986870d1cd

      SHA256

      151873b6bba5317de73979e84ec3f5cc8735cd4fa1fa913557ac7e32f0fe5880

      SHA512

      14c10bb2269686206463b9213cb05266b9939f48e8788c251c357c723ff8ef3d689b9a12797381f84f8b3a5730cbce21f1af0486b3bbc273063de07cb2907892

      Download Submit

    • C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe
      Filesize

      204B

      MD5

      f71d833e6aeb52188ee610b077d8ccc6

      SHA1

      d75cb50568151b006529144b7e9176ceb10d20ec

      SHA256

      fe1e34b8c3b97e4d9d228456cbd70c882751ac3566c4db9ac0c0dd69736a8506

      SHA512

      6b40363e6805bbd53a700df9606ce9005c739f9d03c229f970f5487ffd292454ebefda13155161516ec847abdfb6f61f8c67ffb281a1e476823dd2bf1127da06

      Download Submit

    • C:\winRefruntime\T8Mz9n0cgvFWE.bat
      Filesize

      95B

      MD5

      adf2bf7bf445880f81f96361a56948ef

      SHA1

      59b5b4bc70d488217da1b2c2b5b64d5fc968eb8e

      SHA256

      ad92ed1e126adffda821e88ec4dbb6dab360d69b94871228a63e2dd0601065e0

      SHA512

      202865468a0fa699788afeca8b3b1eb5296e98d56958c2edc0ea83191a192ebb7e620029632e7d7671bee749bf3dd8781d4497f461894f10451edc985c41324e

      Download Submit

    • \winRefruntime\MsAgentDriverruntime.exe
      Filesize

      1.8MB

      MD5

      c3a0c717ed8a025658e5a4c0f53281d9

      SHA1

      1e7eddfcc83d9b03d69dbaaa64e925792fd6c76d

      SHA256

      e1b05cf5e4c9736a90867217dd7208573bacb4822e4083c999a8212cb59c83dd

      SHA512

      c359a40a89d5cf191dd08d81d6077364b6b974e4e83ddaab6ba04df8098aa9742cf73bf5170e5e528cc255c0ceda39905b7a84fa30db2118cc62b855f839a501

      Download Submit

    • memory/2620-39-0x0000000001220000-0x00000000013FA000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2980-13-0x00000000002D0000-0x00000000004AA000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2980-15-0x0000000000670000-0x000000000067E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2980-17-0x00000000006A0000-0x00000000006BC000-memory.dmp

      Filesize

      112KB

      Download

    • memory/2980-19-0x00000000006C0000-0x00000000006D8000-memory.dmp

      Filesize

      96KB

      Download

    • memory/2980-21-0x0000000000680000-0x000000000068C000-memory.dmp

      Filesize

      48KB

      Download