Overview

overview

10

Static

static

3

f0a78b4d2a...87.exe

windows7-x64

10

f0a78b4d2a...87.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2025 04:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe

  • Size

    2.1MB

  • MD5

    4e9ddbfbeb41bd97825e0f79426307cb

  • SHA1

    f7c1150945e4d9ac8f86b0e0c5ee5f2441e1983b

  • SHA256

    f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987

  • SHA512

    b73e5343ef1c7f662e8c134db76a639228eb2ef7e3d3c78648a1b329986243c5d1e43c57541e4f5392dfc44bf967942f093b511cb3dff7390f352168635e2dca

  • SSDEEP

    24576:2TbBv5rUyXVIHaYHemPiKIUdWp9NZAXY000Ub/TdvsXhhbtRtAC+IEZ9rSyzPXcE:IBJwJRIfpxAXalU7tPA3IEHHPo25fNJ

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe
    "C:\Users\Admin\AppData\Local\Temp\f0a78b4d2a7cc344b747116e39e0d59231d05f9b6456392977de364414c9c987.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\winRefruntime\T8Mz9n0cgvFWE.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\winRefruntime\MsAgentDriverruntime.exe
          "C:\winRefruntime/MsAgentDriverruntime.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3680
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iHT1nhUWrx.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1396
            • C:\Windows\system32\chcp.com
              chcp 65001
              6⤵
                PID:388
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                6⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3196
              • C:\Program Files\Windows Media Player\es-ES\SppExtComObj.exe
                "C:\Program Files\Windows Media Player\es-ES\SppExtComObj.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:644

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\iHT1nhUWrx.bat
      Filesize

      188B

      MD5

      12b00f56bd0ac9110d5f2012dfb1beef

      SHA1

      36339981e687f0615411e789090f7385aba0d4a0

      SHA256

      d053c8db5e521a21a0606717a5674c740486afad917739917cf06f11d7b14718

      SHA512

      ffe0ca0f14974235b5f02e64c3b7abbaf2aaa24639cbb75367caa13e1858641ba3dc8e2cacaaace5f9c6fb2db04213eac462ff3b2ff594c1827db1a0e55fa630

      Download Submit

    • C:\winRefruntime\0jfMNzpItgnyb3dolhtjTtJBeKE8V11tqFqpGcy14sQRgDlNdePdmeq.vbe
      Filesize

      204B

      MD5

      f71d833e6aeb52188ee610b077d8ccc6

      SHA1

      d75cb50568151b006529144b7e9176ceb10d20ec

      SHA256

      fe1e34b8c3b97e4d9d228456cbd70c882751ac3566c4db9ac0c0dd69736a8506

      SHA512

      6b40363e6805bbd53a700df9606ce9005c739f9d03c229f970f5487ffd292454ebefda13155161516ec847abdfb6f61f8c67ffb281a1e476823dd2bf1127da06

      Download Submit

    • C:\winRefruntime\MsAgentDriverruntime.exe
      Filesize

      1.8MB

      MD5

      c3a0c717ed8a025658e5a4c0f53281d9

      SHA1

      1e7eddfcc83d9b03d69dbaaa64e925792fd6c76d

      SHA256

      e1b05cf5e4c9736a90867217dd7208573bacb4822e4083c999a8212cb59c83dd

      SHA512

      c359a40a89d5cf191dd08d81d6077364b6b974e4e83ddaab6ba04df8098aa9742cf73bf5170e5e528cc255c0ceda39905b7a84fa30db2118cc62b855f839a501

      Download Submit

    • C:\winRefruntime\T8Mz9n0cgvFWE.bat
      Filesize

      95B

      MD5

      adf2bf7bf445880f81f96361a56948ef

      SHA1

      59b5b4bc70d488217da1b2c2b5b64d5fc968eb8e

      SHA256

      ad92ed1e126adffda821e88ec4dbb6dab360d69b94871228a63e2dd0601065e0

      SHA512

      202865468a0fa699788afeca8b3b1eb5296e98d56958c2edc0ea83191a192ebb7e620029632e7d7671bee749bf3dd8781d4497f461894f10451edc985c41324e

      Download Submit

    • memory/3680-12-0x00007FFEAA063000-0x00007FFEAA065000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3680-13-0x00000000002B0000-0x000000000048A000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/3680-15-0x0000000000DD0000-0x0000000000DDE000-memory.dmp

      Filesize

      56KB

      Download

    • memory/3680-17-0x00000000026E0000-0x00000000026FC000-memory.dmp

      Filesize

      112KB

      Download

    • memory/3680-18-0x0000000002880000-0x00000000028D0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/3680-20-0x0000000002700000-0x0000000002718000-memory.dmp

      Filesize

      96KB

      Download

    • memory/3680-22-0x0000000000DF0000-0x0000000000DFC000-memory.dmp

      Filesize

      48KB

      Download