Overview

overview

10

Static

static

10

taskHostw.exe

windows7-x64

10

taskHostw.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    23-01-2025 15:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    taskHostw.exe

  • Size

    1.1MB

  • MD5

    9acac2f1709100c4f471c5c4d9a6559a

  • SHA1

    b0de7b3d1340bb3edc9b67a6ae2be9d25f1e6172

  • SHA256

    e7fe25f706806440e04205b7fbe8c4dc0bef064327770b7ba7682917090509f5

  • SHA512

    196cea984b335b1cd03032d9002d799cb9bc85fb252f102510da8d3b14e0f02c15627f82c64cdc6ce086cf91e1960c0e3d6fc1bc539c657f1b0ff2e94276f1b8

  • SSDEEP

    24576:U2G/nvxW3Ww0tGyuDFfYdKDe17qJSZLQ+r/kDIdCCj:UbA30yFbaqerDPdF

Score
10/10
dcratcredential_accessdefense_evasiondiscoveryinfostealerratspywarestealertrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
    defense_evasiontrojan
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 6 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\taskHostw.exe
    "C:\Users\Admin\AppData\Local\Temp\taskHostw.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\webfontSessionBrokerHost\Ur1NipdNxN.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2908
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\webfontSessionBrokerHost\SpdD9zKqJDT3l.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\webfontSessionBrokerHost\Bridgebrokerperf.exe
          "C:\webfontSessionBrokerHost\Bridgebrokerperf.exe"
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2924
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sd1ikTBUNS.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2348
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:936
              • C:\Program Files\Windows NT\Accessories\de-DE\winlogon.exe
                "C:\Program Files\Windows NT\Accessories\de-DE\winlogon.exe"
                6⤵
                • UAC bypass
                • Deletes itself
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Drops desktop.ini file(s)
                • Drops autorun.inf file
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:580
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\smss.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2352
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3052
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2376
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2516
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2328
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1060
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\de-DE\winlogon.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1520
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\de-DE\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2500
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\de-DE\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2316
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\System.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1708
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\TAPI\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2420
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\System.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2956

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Replication Through Removable Media

    1
    T1091

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Impair Defenses

    1
    T1562

    Disable or Modify Tools

    1
    T1562.001

    Modify Registry

    2
    T1112

    Credential Access

    Credentials from Password Stores

    2
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Windows Credential Manager

    1
    T1555.004

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Browser Information Discovery

    1
    T1217

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Replication Through Removable Media

    1
    T1091

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\27d1bcfc3c54e0
      Filesize

      966B

      MD5

      1b0c3b6d027d0b3a74e6b9a528e826fb

      SHA1

      c9aa8d2e7394fce181500aab2008e51e8aa7ae26

      SHA256

      c25756eee38bf7e899db9f6f8b0b2cb265a35ca6a75d70bcdce50187e8096e1c

      SHA512

      6d225fd0c46a22b4c46b130e9b5b19a027a942aa69b1346043c1e84427c2e903b0eba42075023e0c06d89ac6fcf3be83b5629d388c27ea54ffb41cf74a75dce7

      Download Submit

    • C:\Program Files\Windows NT\Accessories\de-DE\cc11b995f2a76d
      Filesize

      118B

      MD5

      be7666de303b73c855ead7a6efbe4ad6

      SHA1

      45cf8f7a4d356631720e54b07f0ed714f46ee771

      SHA256

      2aae7efa193daede452aa08547ed87ddfeb71f4f399e205dfc78505e8d34f0e7

      SHA512

      5f093d49b7d4342f97053305c1a05659f8e48897bd1c17378ecb7aa588c83e4511b53a31653c3215e8ea3ac467d19b7cd923518a8e436f14eaed93060be8c37c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\sd1ikTBUNS.bat
      Filesize

      223B

      MD5

      29d872559c61dae6a80cb3284afa58d1

      SHA1

      f281ab0021c255105808a29ce09a8b78c09abca6

      SHA256

      c2fba60f51137393cdf249934fb2d97e765aeaf9087ef8f4f9b1df187287c115

      SHA512

      bfabc51615832e8099895ebcc7709e5e4902f8a389751c17562c5db1ebfa4dce8a212107031048f9b755793bd7684934f5f2e9b0c1864af59ffdac551f1471e6

      Download Submit

    • C:\Users\Default\69ddcba757bf72
      Filesize

      654B

      MD5

      1a0f86078f0cc8c8f27c3934369bde3e

      SHA1

      4c885dc3a9ea60dacd9c32cc3f1455c78aa8fd7a

      SHA256

      150ff91ced8c09b9d1276712353d4236cd66b2c91255ee11cb6e7671e25315d9

      SHA512

      93f47f7c2ac7a342645a1f49265e32271de648be8f317b7b1968c2acaaac7264582aed21729c607b6dabd2779972d4c5d5f7f3c3db51dca9fbfd4c0c4c833492

      Download Submit

    • C:\webfontSessionBrokerHost\SpdD9zKqJDT3l.bat
      Filesize

      50B

      MD5

      37e781c64e1e5057220cc587925258d4

      SHA1

      3cd34c35d3d528b8ec2952d6c616cc3896b2dc66

      SHA256

      24510bbfd8f20c029b17d88853e82dbc2d2637b52dc76be8ceebf57243cac344

      SHA512

      3fa6c68ea554401af69bdf21061b17d9c068a2e7f42b2901c4a3e18d14aae7b52706fd24edc2f2da06db806a8b3d00dbdbfe3b963d72945af0801c8c3c9840ba

      Download Submit

    • C:\webfontSessionBrokerHost\Ur1NipdNxN.vbe
      Filesize

      215B

      MD5

      56f8dfb763248f67943afcc431c9a28c

      SHA1

      b31a8e990b3971d27bbb0ff1c9bcff6fbaf33211

      SHA256

      db5202acf3a53d23f14faa846e27c2415cb33c26b5ac151a298209a0e7a1e4ac

      SHA512

      c0a81de45024a042abfc5876f3fde486b2ae809ac2d5ff099cd2d288ba863b0bff86cf4d6fda335a7eb40a2c26218e3ffb417d20b7167c9dd54be4b74e921b6b

      Download Submit

    • \webfontSessionBrokerHost\Bridgebrokerperf.exe
      Filesize

      865KB

      MD5

      1465b464ff78a41cf8af12d58ca62588

      SHA1

      9c4904b19b2b111c9c96cb0aba28aa3413b54c83

      SHA256

      485228dc5bfeb7694133fd50861f0c48f314003f8ee1030db3d063d07930bd3a

      SHA512

      c609086d161150a3754240aab9f76904a221314374b7b5c373bd9548bce6ec1cce509564523c9b8b2a16710f8ecbe558dd7b8f62adecc2007fe83320a19bdb0b

      Download Submit

    • memory/580-30-0x00000000000F0000-0x00000000001D0000-memory.dmp

      Filesize

      896KB

      Download

    • memory/2924-13-0x0000000000C90000-0x0000000000D70000-memory.dmp

      Filesize

      896KB

      Download

    • memory/2924-14-0x00000000001C0000-0x00000000001CA000-memory.dmp

      Filesize

      40KB

      Download