Analysis
-
max time kernel
3s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/03/2025, 16:32
General
-
Target
a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b.exe
-
Size
1.8MB
-
MD5
7aeff3c38c61da155b557c651866241d
-
SHA1
5d17e805d332b43df01153884c040524cc150f4b
-
SHA256
a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b
-
SHA512
364ce21ba3427e0951f274b8ac7ba76e9e18877d3a49bd3de1ff24525d0f499f9c2ec2b0336a266852d308bfcb3e02c977c512b0b3917df3e497965fc3b9c72e
-
SSDEEP
24576:N9US2Qh9vbixa8FAPOZEl2dQE98Kt7fgZizgXVWA1CiFoe9+Qoi8M3wfCI9GfkW2:N9LPOIK5ui8pciKi+QoW3wD9aFuH
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 57 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b.exe"C:\Users\Admin\AppData\Local\Temp\a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qt4u4frz\qt4u4frz.cmdline"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES24DF.tmp" "c:\Windows\System32\CSC60D1818450F44D4FAD6D7794DF710C.TMP"3⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD57aeff3c38c61da155b557c651866241d
SHA15d17e805d332b43df01153884c040524cc150f4b
SHA256a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b
SHA512364ce21ba3427e0951f274b8ac7ba76e9e18877d3a49bd3de1ff24525d0f499f9c2ec2b0336a266852d308bfcb3e02c977c512b0b3917df3e497965fc3b9c72e
-
Filesize
1KB
MD5d6a3551df599f190bbbb0eb6e692260e
SHA1662244c67d55550ba9bb3594a99551595510f75f
SHA25643185b2e6507ef45bbfada48da7bea52d300bb60713845efa12830704b50775d
SHA512e58f247077afff79d97ed54db420c187a19c96ccc6d2600836c1255d43c46a7183c0280ffdbc409785ad81bb875ea7faabeb1e0cc80e45d04fc8c9e4dc0db7b2
-
Filesize
407B
MD559b15668d71ec72f09e485e24aa452c7
SHA1a6e08e00715042d40270dc527ef5a66226e7fcfa
SHA256215a09649d9d3834e395169d919878919a81858e292e4d3a3b8aeb77ee276939
SHA512fc0299ce9463b73bdbd29c234d7472b2ee69f7a772e0d4182e2aeeb07d25eab80859dc52ebae3432efd4bdde8bc0a471582347cdbc2620f7c42ef6cdcc97490a
-
Filesize
235B
MD55036e77fe097dc08acab0ab8ca2f88a2
SHA1e8eef7b615cd1134aebd0913679e7fceeee96f03
SHA25608bd658d2388bad5f0c6efc30834558f809ac8885876ee9f3412b4c38bb68e40
SHA5126ec971dec115fb2fd34591be84daba2156379dcdbe54d8bb9bdb4833c953b7a99848f7a48e31c9788c566485c393924f732fff237e9b6d8e46b144cb42ee0105
-
Filesize
1KB
MD5167c870490dc33ec13a83ebb533b1bf6
SHA1182378ebfa7c8372a988dee50a7dd6f8cda6a367
SHA2563f742a374ad5a8da8fba9dfea27c7382dde145d46732cfc0002a53a1311df5e6
SHA5121b48bb5f270f5d99d9dd98cd9da5866aed9377957d92bf1d686878522c438b38a444073c1a0ed4cc85f97315d2ef6abf05b74ab2265fecb20be5795b2ccef64e
-
Filesize
112KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
48KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
1.9MB