Analysis

  • max time kernel
    101s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:09

General

  • Target

    35459ca7521a8565cf4acaadd346537b.exe

  • Size

    984KB

  • MD5

    35459ca7521a8565cf4acaadd346537b

  • SHA1

    c22ce5beb121ecbba910dec28dedc0781d379524

  • SHA256

    9622708341e5ac35563f5f258ae7736ad0a9f3c5875cfbf6e4570778b2e2c8bb

  • SHA512

    691dc64caeb7a892b54c970f5d750a47a525004b162994c7e71eefbd4821c5c65961b2bbf08c356799e005de7c258fede7058cc3cc7f939f5ce1cd4ba40becd1

  • SSDEEP

    12288:LzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:LzZvuGD2PvA5YxwmbZB6Uv

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 5 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\35459ca7521a8565cf4acaadd346537b.exe
    "C:\Users\Admin\AppData\Local\Temp\35459ca7521a8565cf4acaadd346537b.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Program Files\edge_BITS_4640_720052988\SearchApp.exe
      "C:\Program Files\edge_BITS_4640_720052988\SearchApp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1180
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ShellComponents\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:5988
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\WcnNetsh\SppExtComObj.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:5132
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\lusrmgr\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3240
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4640_720052988\SearchApp.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3496
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\Faultrep\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\edge_BITS_4640_720052988\RCX9704.tmp

    Filesize

    984KB

    MD5

    905ac4eeeb2b7a2d763f8928fabd4f27

    SHA1

    9636415c120d5148de17c297990c2615478c45c2

    SHA256

    3b451406529d82d4748e010f9036f82b7b195faaf9fff40b565f1184520227b3

    SHA512

    5d8700935f6f5b28af7bb28c3108e099fdba38fb606753a29c6dc2075b5e8a164cd5263d1342feff4a6e385c9c234d337138a4bc54ea91731a1c626fdd54451b

  • C:\Windows\System32\Faultrep\lsass.exe

    Filesize

    984KB

    MD5

    35459ca7521a8565cf4acaadd346537b

    SHA1

    c22ce5beb121ecbba910dec28dedc0781d379524

    SHA256

    9622708341e5ac35563f5f258ae7736ad0a9f3c5875cfbf6e4570778b2e2c8bb

    SHA512

    691dc64caeb7a892b54c970f5d750a47a525004b162994c7e71eefbd4821c5c65961b2bbf08c356799e005de7c258fede7058cc3cc7f939f5ce1cd4ba40becd1

  • C:\Windows\System32\lusrmgr\spoolsv.exe

    Filesize

    984KB

    MD5

    5e32dec729e60705c28224e935159224

    SHA1

    cbbd2faca342c14053b72e0439f983b511e30c6d

    SHA256

    b924a0300e5232a0f423d7f9191c875828bd09c8d791ae0909cf26ee1441bd97

    SHA512

    73bdead582bd78cbba4a8ed3659c60f3feb316b62dca63e928e0681d3be73194ff55f4656453f4a5fee9f0856a860ff3c884832a47e66f0cd9cb01cab318fcf8

  • memory/4320-6-0x00000000028A0000-0x00000000028B0000-memory.dmp

    Filesize

    64KB

  • memory/4320-10-0x000000001B2C0000-0x000000001B2D2000-memory.dmp

    Filesize

    72KB

  • memory/4320-5-0x0000000002890000-0x00000000028A0000-memory.dmp

    Filesize

    64KB

  • memory/4320-7-0x000000001B290000-0x000000001B298000-memory.dmp

    Filesize

    32KB

  • memory/4320-8-0x000000001B2A0000-0x000000001B2B0000-memory.dmp

    Filesize

    64KB

  • memory/4320-0-0x00007FFA30643000-0x00007FFA30645000-memory.dmp

    Filesize

    8KB

  • memory/4320-9-0x000000001B2B0000-0x000000001B2BC000-memory.dmp

    Filesize

    48KB

  • memory/4320-4-0x000000001B860000-0x000000001B8B0000-memory.dmp

    Filesize

    320KB

  • memory/4320-11-0x000000001C0B0000-0x000000001C5D8000-memory.dmp

    Filesize

    5.2MB

  • memory/4320-12-0x000000001B2F0000-0x000000001B2FC000-memory.dmp

    Filesize

    48KB

  • memory/4320-3-0x0000000002870000-0x000000000288C000-memory.dmp

    Filesize

    112KB

  • memory/4320-2-0x00007FFA30640000-0x00007FFA31101000-memory.dmp

    Filesize

    10.8MB

  • memory/4320-1-0x0000000000570000-0x000000000066C000-memory.dmp

    Filesize

    1008KB

  • memory/4320-116-0x00007FFA30640000-0x00007FFA31101000-memory.dmp

    Filesize

    10.8MB