Analysis
- max time kernel
148s - max time network
151s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250217-en - resource tags
- submitted
11/03/2025, 16:14
General
- Target coderoom-main/ntohlsakdth.exe
- Size 2.4MB
- Sample250311-tp2gvsxpv2
- SHA256 77f89edc608310294fb98dd03be1c1b855482cebf1222b7bed671f59961f1b52
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- DCRat payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\coderoom-main\ntohlsakdth.exe"C:\Users\Admin\AppData\Local\Temp\coderoom-main\ntohlsakdth.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7YaSE6Rvkt.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7YaSE6Rvkt.bat
staticfile.exe
memory/3800-88-0x000000001C1D0000-0x000000001C23B000-memory.dmp
memory/3800-89-0x000000001D490000-0x000000001D5A4000-memory.dmp
memory/3880-31-0x000000001BF50000-0x000000001BF66000-memory.dmp
memory/3880-33-0x000000001BF70000-0x000000001BF82000-memory.dmp
memory/3880-9-0x000000001BC90000-0x000000001BCAC000-memory.dmp
memory/3880-10-0x00000000019A0000-0x00000000019BC000-memory.dmp
memory/3880-12-0x000000001BE80000-0x000000001BED0000-memory.dmp
memory/3880-14-0x00000000019C0000-0x00000000019D0000-memory.dmp
memory/3880-11-0x00007FF833B70000-0x00007FF834632000-memory.dmp
memory/3880-16-0x000000001BED0000-0x000000001BEE8000-memory.dmp
memory/3880-18-0x000000001BD40000-0x000000001BD50000-memory.dmp
memory/3880-20-0x000000001BD50000-0x000000001BD60000-memory.dmp
memory/3880-23-0x000000001BD60000-0x000000001BD6E000-memory.dmp
memory/3880-21-0x00007FF833B70000-0x00007FF834632000-memory.dmp
memory/3880-25-0x000000001BF10000-0x000000001BF22000-memory.dmp
memory/3880-28-0x000000001BEF0000-0x000000001BF00000-memory.dmp
memory/3880-0-0x00007FF833B73000-0x00007FF833B75000-memory.dmp
memory/3880-26-0x00007FF833B70000-0x00007FF834632000-memory.dmp
memory/3880-29-0x00007FF833B70000-0x00007FF834632000-memory.dmp
memory/3880-7-0x0000000001990000-0x000000000199E000-memory.dmp
memory/3880-34-0x00007FF833B70000-0x00007FF834632000-memory.dmp
memory/3880-36-0x000000001C4C0000-0x000000001C9E8000-memory.dmp
memory/3880-38-0x000000001BF00000-0x000000001BF0E000-memory.dmp
memory/3880-40-0x000000001BF30000-0x000000001BF40000-memory.dmp
memory/3880-35-0x00007FF833B70000-0x00007FF834632000-memory.dmp
memory/3880-42-0x000000001BF40000-0x000000001BF50000-memory.dmp
memory/3880-44-0x000000001BFF0000-0x000000001C04A000-memory.dmp
memory/3880-46-0x000000001BF90000-0x000000001BF9E000-memory.dmp
memory/3880-48-0x000000001BFA0000-0x000000001BFB0000-memory.dmp
memory/3880-50-0x000000001BFB0000-0x000000001BFBE000-memory.dmp
memory/3880-52-0x000000001C050000-0x000000001C068000-memory.dmp
memory/3880-54-0x000000001C0C0000-0x000000001C10E000-memory.dmp
memory/3880-5-0x00007FF833B70000-0x00007FF834632000-memory.dmp
memory/3880-65-0x00007FF833B70000-0x00007FF834632000-memory.dmp
memory/3880-4-0x0000000003290000-0x00000000032B6000-memory.dmp
memory/3880-2-0x00007FF833B70000-0x00007FF834632000-memory.dmp
memory/3880-1-0x0000000000E70000-0x00000000010E0000-memory.dmp