Overview

overview

10

Static

static

10

b39b2723e3...6N.exe

windows7-x64

10

b39b2723e3...6N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-01-2025 13:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b39b2723e3217a332fcc41aad66fcae56939e5368d2abbdbff0c874b84aea9e6N.exe

  • Size

    952KB

  • MD5

    44166bd2a126a97a6db8049255377240

  • SHA1

    470b088d19c3f3395e313a49d7b6ef6527a40d42

  • SHA256

    b39b2723e3217a332fcc41aad66fcae56939e5368d2abbdbff0c874b84aea9e6

  • SHA512

    482e1fc386b985e82bbe477d8b21eeb50192d03a6fcaf91abf4ec8c464708d65bcdeb49b9cfbf86f468db74e273a78999207e75a66c0a527a2ae1a8db6ce3531

  • SSDEEP

    24576:W+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:x8/KfRTK

Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 5 IoCs
    persistence
  • Process spawned unexpected child process 5 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b39b2723e3217a332fcc41aad66fcae56939e5368d2abbdbff0c874b84aea9e6N.exe
    "C:\Users\Admin\AppData\Local\Temp\b39b2723e3217a332fcc41aad66fcae56939e5368d2abbdbff0c874b84aea9e6N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1860
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rXUnl1N7G0.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1496
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1984
        • C:\Windows\System32\WindowsCodecsExt\csrss.exe
          "C:\Windows\System32\WindowsCodecsExt\csrss.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:1952
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\synceng\dllhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2972
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\WindowsCodecsExt\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2816
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\wlanapi\lsm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2736
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\WPDShextAutoplay\lsass.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2704
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\audiodg.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2168

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Impair Defenses

    1
    T1562

    Disable or Modify Tools

    1
    T1562.001

    Modify Registry

    4
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\audiodg.exe
      Filesize

      952KB

      MD5

      44166bd2a126a97a6db8049255377240

      SHA1

      470b088d19c3f3395e313a49d7b6ef6527a40d42

      SHA256

      b39b2723e3217a332fcc41aad66fcae56939e5368d2abbdbff0c874b84aea9e6

      SHA512

      482e1fc386b985e82bbe477d8b21eeb50192d03a6fcaf91abf4ec8c464708d65bcdeb49b9cfbf86f468db74e273a78999207e75a66c0a527a2ae1a8db6ce3531

      Download Submit

    • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\audiodg.exe
      Filesize

      952KB

      MD5

      4f467a210f5241db48536f4a3e93e80d

      SHA1

      0bd961bee221663113ed57527cc8f96c779774a7

      SHA256

      f808fee9688e7b3161bf688f5c1e1a473bda12c44f89166a4c376b5ec5360c1e

      SHA512

      12a0be259700ba1dbb539a3e3a5b2f104bf37d11ac3083ebc8addd8d8e90ecb7f466dd291d2b06b56b5592acdd46ec7f875920aba28266e4a851f466e9eb22f3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\rXUnl1N7G0.bat
      Filesize

      210B

      MD5

      c6388ae280421e9dd83da6311bc44f04

      SHA1

      44605e3d567489ee7d08ad96d7f775809c0fb7f7

      SHA256

      1f674f204041f6d8301a97dc65c989d9000d749e5b206409d2bb669571f7b127

      SHA512

      5121bddab8c708f64b5fda49bab5b79372aa277124d2193cd5c8d57c0226d6a9b4a9d93d8537bea9e9b0e05ba77b5803de7bfa4611f6c885382f6b816cd2be30

      Download Submit

    • memory/1860-4-0x0000000000360000-0x0000000000370000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1860-10-0x00000000004E0000-0x00000000004EC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1860-6-0x0000000000370000-0x000000000037C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1860-5-0x0000000000350000-0x000000000035A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1860-7-0x00000000004C0000-0x00000000004CA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1860-8-0x00000000004D0000-0x00000000004D8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1860-9-0x0000000000420000-0x000000000042A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1860-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1860-11-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1860-3-0x0000000000340000-0x0000000000350000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1860-2-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1860-89-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1860-1-0x00000000012B0000-0x00000000013A4000-memory.dmp

      Filesize

      976KB

      Download

    • memory/1952-93-0x0000000000110000-0x0000000000204000-memory.dmp

      Filesize

      976KB

      Download