Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
19/07/2026, 23:32
General
- Target 642200c3a5bcaeff3ee23a05b6097b24dd70761d3fbab23a913be1aec2a5fcc6.exe
- Size 3.9MB
- Sample260719-3jsgfags2n
- SHA256 642200c3a5bcaeff3ee23a05b6097b24dd70761d3fbab23a913be1aec2a5fcc6
Malware Config
Signatures
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- DCRat payload 2 IoCs
- Disables Task Manager via registry modification
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 7 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies registry class 7 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\642200c3a5bcaeff3ee23a05b6097b24dd70761d3fbab23a913be1aec2a5fcc6.exe"C:\Users\Admin\AppData\Local\Temp\642200c3a5bcaeff3ee23a05b6097b24dd70761d3fbab23a913be1aec2a5fcc6.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\blockdrivermonitornetcommon\UqoZHbhEckaiMIzFLs.vbe"2⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\blockdrivermonitornetcommon\6QEI0YsV4YvzIPCyYOBEJq1qpc6cWKV2MENYjrP8PMM.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\blockdrivermonitornetcommon\bridgePortCrtMonitor.exe"C:\blockdrivermonitornetcommon/bridgePortCrtMonitor.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H2L38gwmQt.bat"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Users\Default User\SearchHost.exe"C:\Users\Default User\SearchHost.exe"6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AntDRUzUoe.bat"7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Default User\SearchHost.exe"C:\Users\Default User\SearchHost.exe"8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MYvr7swJ3g.bat"9⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Default User\SearchHost.exe"C:\Users\Default User\SearchHost.exe"10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HhxybCDMPZ.bat"11⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵
-
-
C:\Users\Default User\SearchHost.exe"C:\Users\Default User\SearchHost.exe"12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8EsK2bkKJG.bat"13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵
-
-
C:\Users\Default User\SearchHost.exe"C:\Users\Default User\SearchHost.exe"14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZLKnXXaim4.bat"15⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵
-
-
C:\Users\Default User\SearchHost.exe"C:\Users\Default User\SearchHost.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
8EsK2bkKJG.bat
AntDRUzUoe.bat
H2L38gwmQt.bat
HhxybCDMPZ.bat
MYvr7swJ3g.bat
ZLKnXXaim4.bat
6QEI0YsV4YvzIPCyYOBEJq1qpc6cWKV2MENYjrP8PMM.bat
UqoZHbhEckaiMIzFLs.vbe
bridgePortCrtMonitor.exe
memory/1516-29-0x000000001B610000-0x000000001B622000-memory.dmp
memory/1516-33-0x000000001B5E0000-0x000000001B5F0000-memory.dmp
memory/1516-22-0x000000001B4E0000-0x000000001B4F0000-memory.dmp
memory/1516-23-0x000000001B4F0000-0x000000001B500000-memory.dmp
memory/1516-24-0x000000001B520000-0x000000001B52E000-memory.dmp
memory/1516-25-0x000000001B580000-0x000000001B58E000-memory.dmp
memory/1516-26-0x000000001B5B0000-0x000000001B5C2000-memory.dmp
memory/1516-27-0x000000001B590000-0x000000001B5A0000-memory.dmp
memory/1516-28-0x000000001B5F0000-0x000000001B606000-memory.dmp
memory/1516-20-0x000000001B3F0000-0x000000001B400000-memory.dmp
memory/1516-30-0x000000001BB60000-0x000000001C088000-memory.dmp
memory/1516-31-0x000000001B5A0000-0x000000001B5AE000-memory.dmp
memory/1516-32-0x000000001B5D0000-0x000000001B5E0000-memory.dmp
memory/1516-21-0x000000001B500000-0x000000001B518000-memory.dmp
memory/1516-34-0x000000001B690000-0x000000001B6EA000-memory.dmp
memory/1516-35-0x000000001B630000-0x000000001B63E000-memory.dmp
memory/1516-36-0x000000001B640000-0x000000001B650000-memory.dmp
memory/1516-37-0x000000001B650000-0x000000001B65E000-memory.dmp
memory/1516-38-0x000000001B6F0000-0x000000001B708000-memory.dmp
memory/1516-39-0x000000001B660000-0x000000001B66C000-memory.dmp
memory/1516-40-0x000000001B760000-0x000000001B7AE000-memory.dmp
memory/1516-19-0x000000001B530000-0x000000001B580000-memory.dmp
memory/1516-18-0x00000000026F0000-0x000000000270C000-memory.dmp
memory/1516-17-0x000000001B480000-0x000000001B49C000-memory.dmp
memory/1516-16-0x00000000026E0000-0x00000000026EE000-memory.dmp
memory/1516-15-0x000000001B450000-0x000000001B476000-memory.dmp
memory/1516-14-0x00000000001B0000-0x000000000054C000-memory.dmp