Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/01/2025, 04:30

General

  • Target

    6e333e5b68668934186d53525c24d2ed857c35e36b4d21102d06e52e6890ac5f.exe

  • Size

    2.7MB

  • MD5

    9f7d0b9a32de0f6cefb6a3328f833034

  • SHA1

    b2f45dab2c76093c317cab36a47873e55e2c7c6e

  • SHA256

    6e333e5b68668934186d53525c24d2ed857c35e36b4d21102d06e52e6890ac5f

  • SHA512

    0ead99e58a9d244f308405a1cff664479de57f1ee38014a557642ef1ea3fe52f20f433c17da565ea23168a8b8c416fcbcb43e6d3df0c959341d36f592fb97f1d

  • SSDEEP

    49152:bBu+dK3GaaTUukCTXO2s2f1sKfmFRd0MdOa5k1kpm/Ufn6sC:duyjAi+j2aK+F54/U/6s

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 7 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e333e5b68668934186d53525c24d2ed857c35e36b4d21102d06e52e6890ac5f.exe
    "C:\Users\Admin\AppData\Local\Temp\6e333e5b68668934186d53525c24d2ed857c35e36b4d21102d06e52e6890ac5f.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2936
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wNL0dL8YnE.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1292
        • C:\Users\Public\Favorites\WmiPrvSE.exe
          "C:\Users\Public\Favorites\WmiPrvSE.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:1644
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\System\System.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2640
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\PLA\System\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1688
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\PLA\System\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2256
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3020
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:636
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1424
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\wininit.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1792
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2612
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2208
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\System.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2156
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:836
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2864
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\security\database\winlogon.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1748
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\security\database\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2132
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\security\database\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1148
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Journal\es-ES\OSPPSVC.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2040
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1044
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1272
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Favorites\WmiPrvSE.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2764
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Favorites\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1756
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Favorites\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1720

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Windows Journal\es-ES\OSPPSVC.exe

      Filesize

      2.7MB

      MD5

      10caf3bf43275f676d9b8e6f1dd08d67

      SHA1

      11889fe3a958f7e212e0c91a3045c71bf0ac2d3b

      SHA256

      6ceddd3a1fa98adbc64370d0d27635d52201f2c7a24f3466eb5ec06abb2ffb42

      SHA512

      c679f1ec3db90aeb163ae58117e75dd27f666240b004c8f553c35ce8a472bed1171e92da0f809a6c1fead0f524ccdf8a14cca1430387d35c97771949c8085a44

    • C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\System.exe

      Filesize

      2.7MB

      MD5

      8f84da8a73202bbbc5f3da5ad19dff11

      SHA1

      e0c53b5832b6072ec89a636935828700eedff32f

      SHA256

      9c502beab345b2b6ae500adfb41a25057b0465fda0b407ddbe26ea0b3774677c

      SHA512

      38c5a40759dbeaf3c646ec8430816093633956731247a9015fe478e3ea434047c296a2c0bc4dd31e27e43a2c8c3564a6e39dbad7a7ebf4a2c6961ab572e14da4

    • C:\Users\Admin\AppData\Local\Temp\wNL0dL8YnE.bat

      Filesize

      203B

      MD5

      81a1c2fe4c882460f074229648ce688d

      SHA1

      2240f5fc5c0679d422e8236563d860f2f90c95d2

      SHA256

      f5672c2f6f91a9a10a70446d9518f969cf1af751cc07636c12adf8fbf4997b30

      SHA512

      a6d1fd3d187c87be1502d0c9e66b54a74ac4eb3e8acc468a9a9c24b1e1ce33db3f3586b41e96a94b58348a2d39489fa03a6477125ee14b68b58a21a351badb43

    • C:\Users\Public\Favorites\WmiPrvSE.exe

      Filesize

      2.7MB

      MD5

      42a380311443f99f82f60ace43593a67

      SHA1

      f1c58be9a8bdf7981d9608ea4c034498cb355feb

      SHA256

      ce5de6d6302b7d95438402feb038b116c2e9a29bf563956558d36145ff5e74c9

      SHA512

      e920fb69ffe85dbeb5e40d009a59349da6608138f8ab728c1c2f49d3c2853546d3832fabd4a0152160fc25ddccced69e01b2fb330344ee5bf57c7c3aab91ffe5

    • C:\Windows\PLA\System\System.exe

      Filesize

      2.7MB

      MD5

      109b5cb9fd42d796d646a79486f7d6a2

      SHA1

      1684597a8b66e56050ae23973ee1ffed55a3ea21

      SHA256

      f1abafb7ed10e847dae29ca5f4241922031406fdd598e5132448b4c72f234ffa

      SHA512

      bd58d39ebfdacad48bddce44e7d865a249115e19b1060d0b57ddaf151c70587d9cb299754d31938e143c4ef0ea822091c9b95eb24acd9ff4950d6045ad429d09

    • C:\Windows\security\database\winlogon.exe

      Filesize

      2.7MB

      MD5

      9f7d0b9a32de0f6cefb6a3328f833034

      SHA1

      b2f45dab2c76093c317cab36a47873e55e2c7c6e

      SHA256

      6e333e5b68668934186d53525c24d2ed857c35e36b4d21102d06e52e6890ac5f

      SHA512

      0ead99e58a9d244f308405a1cff664479de57f1ee38014a557642ef1ea3fe52f20f433c17da565ea23168a8b8c416fcbcb43e6d3df0c959341d36f592fb97f1d

    • memory/1644-130-0x0000000000620000-0x0000000000676000-memory.dmp

      Filesize

      344KB

    • memory/1644-129-0x0000000000E50000-0x0000000001104000-memory.dmp

      Filesize

      2.7MB

    • memory/2936-7-0x000000001AB00000-0x000000001AB16000-memory.dmp

      Filesize

      88KB

    • memory/2936-19-0x000000001AF30000-0x000000001AF3A000-memory.dmp

      Filesize

      40KB

    • memory/2936-10-0x000000001AC40000-0x000000001AC4A000-memory.dmp

      Filesize

      40KB

    • memory/2936-11-0x000000001AC50000-0x000000001ACA6000-memory.dmp

      Filesize

      344KB

    • memory/2936-12-0x000000001AB30000-0x000000001AB38000-memory.dmp

      Filesize

      32KB

    • memory/2936-13-0x000000001AEB0000-0x000000001AEC2000-memory.dmp

      Filesize

      72KB

    • memory/2936-14-0x000000001AEE0000-0x000000001AEE8000-memory.dmp

      Filesize

      32KB

    • memory/2936-15-0x000000001AEF0000-0x000000001AEF8000-memory.dmp

      Filesize

      32KB

    • memory/2936-16-0x000000001AF00000-0x000000001AF0C000-memory.dmp

      Filesize

      48KB

    • memory/2936-17-0x000000001AF10000-0x000000001AF1E000-memory.dmp

      Filesize

      56KB

    • memory/2936-18-0x000000001AF20000-0x000000001AF2C000-memory.dmp

      Filesize

      48KB

    • memory/2936-9-0x000000001AB20000-0x000000001AB28000-memory.dmp

      Filesize

      32KB

    • memory/2936-20-0x000000001AF40000-0x000000001AF4C000-memory.dmp

      Filesize

      48KB

    • memory/2936-8-0x0000000002320000-0x0000000002328000-memory.dmp

      Filesize

      32KB

    • memory/2936-0-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

      Filesize

      4KB

    • memory/2936-6-0x0000000002210000-0x0000000002220000-memory.dmp

      Filesize

      64KB

    • memory/2936-5-0x0000000002180000-0x0000000002188000-memory.dmp

      Filesize

      32KB

    • memory/2936-4-0x0000000002160000-0x000000000217C000-memory.dmp

      Filesize

      112KB

    • memory/2936-3-0x00000000008A0000-0x00000000008AE000-memory.dmp

      Filesize

      56KB

    • memory/2936-126-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

      Filesize

      9.9MB

    • memory/2936-2-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

      Filesize

      9.9MB

    • memory/2936-1-0x0000000000160000-0x0000000000414000-memory.dmp

      Filesize

      2.7MB