Analysis
-
max time kernel
92s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-01-2025 04:48
General
-
Target
601c80172781fb1a9442666be536e617c330f822f9f4f467d7608f7d81eaeabe.exe
-
Size
952KB
-
MD5
dd96a30a7bca43cb9a3dcece5b8402a5
-
SHA1
831695e0af7321506f7a67f5957d0a9b50bd1e77
-
SHA256
601c80172781fb1a9442666be536e617c330f822f9f4f467d7608f7d81eaeabe
-
SHA512
854ff9d2b117922b1e7cb8c9e96a1c2a3e6c3746005c2a2f76e4e7d468e245258308342c0ed9e3940eb95a4b2ae0798ddb0bbd2e97a851b8cee370ffcdb9acd8
-
SSDEEP
24576:W+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX+:x8/KfRTKE
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 7 IoCs
-
Process spawned unexpected child process 7 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 6 IoCs
-
DCRat payload 4 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Drops file in Program Files directory 10 IoCs
-
Drops file in Windows directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
System policy modification 1 TTPs 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\601c80172781fb1a9442666be536e617c330f822f9f4f467d7608f7d81eaeabe.exe"C:\Users\Admin\AppData\Local\Temp\601c80172781fb1a9442666be536e617c330f822f9f4f467d7608f7d81eaeabe.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PWMepmJliY.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\PerfLogs\601c80172781fb1a9442666be536e617c330f822f9f4f467d7608f7d81eaeabe.exe"C:\PerfLogs\601c80172781fb1a9442666be536e617c330f822f9f4f467d7608f7d81eaeabe.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\setup\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Search\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\notepad\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "601c80172781fb1a9442666be536e617c330f822f9f4f467d7608f7d81eaeabe" /sc ONLOGON /tr "'C:\PerfLogs\601c80172781fb1a9442666be536e617c330f822f9f4f467d7608f7d81eaeabe.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
952KB
MD5dd96a30a7bca43cb9a3dcece5b8402a5
SHA1831695e0af7321506f7a67f5957d0a9b50bd1e77
SHA256601c80172781fb1a9442666be536e617c330f822f9f4f467d7608f7d81eaeabe
SHA512854ff9d2b117922b1e7cb8c9e96a1c2a3e6c3746005c2a2f76e4e7d468e245258308342c0ed9e3940eb95a4b2ae0798ddb0bbd2e97a851b8cee370ffcdb9acd8
-
Filesize
952KB
MD53ba8c005efd2b961da81a5ebae02566c
SHA19d317277c72e9f48bb7f77abd24250a86c860d89
SHA256472e3243b7a03d072102a491a8d008038b28d5125d1a61daef2eb494adbba017
SHA51220e4d69ecc4c2a8a2fb47d939ab454c8258ecb8e8eeb18320b81ed9c733a620342c65e771b270cc66dcaaf09bc309a9baea0a1ad1e71fe5764de2cf44821a1b0
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
244B
MD5688513293e2d948876be1abb309f3e8b
SHA136c86ea2f7f9f608777d7650cc62c1cfccb2507a
SHA2561f28b64cf129118ef363f7c372957ca87269ab466d749a47a54c3da1dad489b5
SHA512e84df9dfdbcce6d0ea44f12fd3b6165a81ab41853d3e08a4475aa40d72af4954de529c80f173ca6a225a9cac1b98f7fd4fe1dacf02e235e0f4c7f4c9e225575b
-
Filesize
952KB
MD57287a4184bd7fe255fdbd6d4c47e0730
SHA162272c82310a5d7fbbb5469260ddb2002b3ba5c2
SHA256b4542274ad9e283155a8f09957c8441310b153bf2ea5f506bcd856ef616f95e6
SHA512e416f59b4491cf88ecc32303fb320f613800a00d73acb9b4486d16d3f964e4cbe75b77d81138f37b606b4166bc68741fe4792517637c74b066b2ff6c447f710c
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
976KB