Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
30/04/2026, 09:50
General
- Target Hardserialnumber.exe
- Size 1.1MB
- Sample260430-lt7wfac16w
- SHA256 223733ec708531603b51bf10fc3126cb4dfd47f4aaada4a75acd168eb06b9d50
Malware Config
Signatures
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Executes dropped EXE 7 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hardserialnumber.exe"C:\Users\Admin\AppData\Local\Temp\Hardserialnumber.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\containercomponentsaves\oiF5KfJ33iaZc9bYA.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\containercomponentsaves\KRJsmLXE.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\containercomponentsaves\chaincommonitor.exe"C:\containercomponentsaves\chaincommonitor.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OyPGkKXBTT.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Program Files\Microsoft Office\Office16\System.exe"C:\Program Files\Microsoft Office\Office16\System.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\containercomponentsaves\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\containercomponentsaves\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\containercomponentsaves\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\containercomponentsaves\WUDFHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\containercomponentsaves\WUDFHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 6 /tr "'C:\containercomponentsaves\WUDFHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office16\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office16\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\containercomponentsaves\conhost.exe"C:\containercomponentsaves\conhost.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Reference Assemblies\lsass.exe"C:\Program Files\Reference Assemblies\lsass.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Microsoft Office\Office16\System.exe"C:\Program Files\Microsoft Office\Office16\System.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\containercomponentsaves\WUDFHost.exe"C:\containercomponentsaves\WUDFHost.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Windows Photo Viewer\uk-UA\lsass.exe"C:\Program Files\Windows Photo Viewer\uk-UA\lsass.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
lsass.exe.log
OyPGkKXBTT.bat
KRJsmLXE.bat
chaincommonitor.exe
oiF5KfJ33iaZc9bYA.vbe
memory/568-25-0x000002D1B4740000-0x000002D1B47DE000-memory.dmp
memory/900-69-0x000000001BAD0000-0x000000001C27E000-memory.dmp
memory/900-70-0x0000000002910000-0x000000000291C000-memory.dmp
memory/1380-67-0x000000001BD60000-0x000000001BD6C000-memory.dmp
memory/1380-66-0x000000001D000000-0x000000001D7AE000-memory.dmp
memory/1536-31-0x0000022E83440000-0x0000022E834DE000-memory.dmp
memory/1560-76-0x0000000002360000-0x000000000236C000-memory.dmp
memory/1560-75-0x000000001B3E0000-0x000000001BB8E000-memory.dmp
memory/1752-10-0x0000000003F00000-0x0000000003F1D000-memory.dmp
memory/1752-11-0x0000000003F20000-0x0000000003F3D000-memory.dmp
memory/1752-9-0x00000000035C0000-0x00000000036BE000-memory.dmp
memory/1808-22-0x000001C2E94A0000-0x000001C2E953E000-memory.dmp
memory/2244-32-0x0000019C090C0000-0x0000019C0915E000-memory.dmp
memory/2324-42-0x000002ABCAA80000-0x000002ABCAB1E000-memory.dmp
memory/2344-26-0x0000029C2E580000-0x0000029C2E61E000-memory.dmp
memory/2520-64-0x0000000001220000-0x000000000122C000-memory.dmp
memory/2520-63-0x000000001BB30000-0x000000001C2DE000-memory.dmp
memory/3316-28-0x0000021AE0DD0000-0x0000021AE0E6E000-memory.dmp
memory/3360-38-0x0000028235730000-0x00000282357CE000-memory.dmp
memory/3396-71-0x000000001B2D0000-0x000000001BA7E000-memory.dmp
memory/3396-72-0x0000000002330000-0x000000000233C000-memory.dmp
memory/3396-73-0x000000001C440000-0x000000001C452000-memory.dmp
memory/3480-61-0x000000001BF00000-0x000000001BF0C000-memory.dmp
memory/3480-60-0x000000001D000000-0x000000001D7AE000-memory.dmp
memory/3976-36-0x0000025376F40000-0x0000025376FDE000-memory.dmp
memory/4092-33-0x000002AF5FAF0000-0x000002AF5FB8E000-memory.dmp
memory/4152-21-0x000001E52D0A0000-0x000001E52D13E000-memory.dmp
memory/4176-27-0x00000208C9EF0000-0x00000208C9F8E000-memory.dmp
memory/4312-39-0x0000018B16230000-0x0000018B162CE000-memory.dmp
memory/4788-37-0x000001D707150000-0x000001D7071EE000-memory.dmp
memory/5016-20-0x0000019C167D0000-0x0000019C1686E000-memory.dmp
memory/5024-45-0x000000001BCC0000-0x000000001C46E000-memory.dmp
memory/5024-47-0x0000000002BE0000-0x0000000002BEC000-memory.dmp
memory/5024-15-0x0000000000990000-0x0000000000A66000-memory.dmp