Analysis
-
max time kernel
5s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
28/03/2025, 16:13
General
-
Target
a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b.exe
-
Size
1.8MB
-
MD5
7aeff3c38c61da155b557c651866241d
-
SHA1
5d17e805d332b43df01153884c040524cc150f4b
-
SHA256
a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b
-
SHA512
364ce21ba3427e0951f274b8ac7ba76e9e18877d3a49bd3de1ff24525d0f499f9c2ec2b0336a266852d308bfcb3e02c977c512b0b3917df3e497965fc3b9c72e
-
SSDEEP
24576:N9US2Qh9vbixa8FAPOZEl2dQE98Kt7fgZizgXVWA1CiFoe9+Qoi8M3wfCI9GfkW2:N9LPOIK5ui8pciKi+QoW3wD9aFuH
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 63 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b.exe"C:\Users\Admin\AppData\Local\Temp\a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fkhwcfe3\fkhwcfe3.cmdline"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES816F.tmp" "c:\Windows\System32\CSCBAD955D5A6824D20BE854E8545731A39.TMP"3⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Ease of Access Themes\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Resources\Ease of Access Themes\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD512b66486588f143c6a20b6fc0ca5fff7
SHA1d65175f3105ca02c9447477bed0da6c33889dbf7
SHA25641fdd1bc634ebaf4bcf0dd0e1dc6df620f0bf7e37d8990aba43bb1e970928610
SHA512ba8ca723b73c80f33ac94517143bdd6ac648f7e353b1c17b9e272a052f22c6a99972076a9b6c9b9786d25e68e57abee54bb42fb49dbea39666f70461b7bba47d
-
Filesize
1.8MB
MD57aeff3c38c61da155b557c651866241d
SHA15d17e805d332b43df01153884c040524cc150f4b
SHA256a447b03f131289f91c8fc4e22ab9b54d362e7771e7ce7518463ea6634cce5c8b
SHA512364ce21ba3427e0951f274b8ac7ba76e9e18877d3a49bd3de1ff24525d0f499f9c2ec2b0336a266852d308bfcb3e02c977c512b0b3917df3e497965fc3b9c72e
-
Filesize
384B
MD5df7d09a698efeb7f05dcd163f949d9ab
SHA16ab5fa2c8d7899f62d424c958a3e3d2268bb4fe8
SHA2569e61157f57733183e813c223152e639612214166f562fa863028011563df1d56
SHA5122b6b71485a865cd194c54a5125a151c3fe65bca898b15af81118cb71edc1276ab1ce4dae15c189f523223b3e0332342d0724531d85e6fadc69f8dece8ddcb960
-
Filesize
235B
MD5326ed1fa2d8490406d88337411001d79
SHA154dc44a4cc9c5f878e5bc81be3b049fabd695b51
SHA256afe10725fe26ec8f5a7e5d85e2dd2e4d74a8e2ca036715ec1d60b160d40c4d34
SHA512834ca5afaca755bf0106fc711ab4addd9e5709e996228cff629295ef50d2b8fcaf2ff8e732006f195f397079f2e3cdab283bdbfef228075442087c1948de7ed4
-
Filesize
1KB
MD5fccbcfaf29fdccaabada579f7aaf3ae7
SHA1f9b179b6aab6b96908d89b35aab3f503478a956d
SHA256e70bc8ad14a70d490fe92ed86e79c40fc133a64428a2781e14514b16d83a9b02
SHA512ac047b4ba060e72e224c1afdebbdafecbfd705a67cb8f0cd5c82bf7980c2baa23bdb5bf5d821836bc0c426069a61d8e112b45239887d2d81b8a6d4fa839c1e10
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
1.9MB