dcrat | dccd3eab40a7320e2d30eabd3bdb5ee0ba29d16176e73f4adf34e3158d50eef8

Analysis

max time kernel
102s
max time network
157s
platform
windows7_x64
resource
win7-20220414-en
submitted
07/07/2022, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DCRatBuild_Full.exe
Size 2.5MB
Sample220707-vypebseee3
SHA256 dccd3eab40a7320e2d30eabd3bdb5ee0ba29d16176e73f4adf34e3158d50eef8
MD5 33cd2f1c0f4310d8f0f8213db3bb5d33
SHA1 83d613769d870049c41b653a0483a7e6cbce7a33
SHA512 59e9b115ff8be09d1cabc4b49d46c3a911c1e17f48eb698b7238cddfd31e8f69fa20dc63ee0414da267421f7180d2556bd2fc8c17901dae557e3923a4fa3321c
MD5 SHA1 SHA512

Score

10^/10

dcrat evasion infostealer persistence rat suricata

Malware Config

Signatures

DcRat 17 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe		Portsurrogatehost.exe
		2020	schtasks.exe
		1628	schtasks.exe
		976	schtasks.exe
		1324	schtasks.exe
		1284	schtasks.exe
		1776	schtasks.exe
		1372	schtasks.exe
		1880	schtasks.exe
		1752	schtasks.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\6203df4a6bafc7		Portsurrogatehost.exe
		1512	schtasks.exe
		1112	schtasks.exe
		1548	schtasks.exe
		1376	schtasks.exe
		1624	schtasks.exe
		1636	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\lsass.exe\", \"C:\\Program Files\\Java\\wininit.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\smss.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\csrss.exe\", \"C:\\Recovery\\3ca42062-bc30-11ec-af8e-f2122c6314cc\\winlogon.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\lsass.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\lsass.exe\", \"C:\\Program Files\\Java\\wininit.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\lsass.exe\", \"C:\\Program Files\\Java\\wininit.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\smss.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\lsass.exe\", \"C:\\Program Files\\Java\\wininit.exe\", \"C:\\Program Files\\Windows Journal\\it-IT\\smss.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\csrss.exe\""	Portsurrogatehost.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	1876	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	1876	schtasks.exe	33

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000012711-63.dat	dcrat
behavioral1/files/0x0007000000012711-64.dat	dcrat
behavioral1/files/0x0007000000012711-65.dat	dcrat
behavioral1/files/0x0007000000012711-67.dat	dcrat
behavioral1/memory/2044-68-0x00000000000A0000-0x00000000002E4000-memory.dmp	dcrat
behavioral1/files/0x00070000000133fa-76.dat	dcrat
behavioral1/files/0x00070000000133fa-77.dat	dcrat
behavioral1/memory/1300-78-0x0000000000D20000-0x0000000000F64000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2044	Portsurrogatehost.exe
1300	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
1296	cmd.exe
1296	cmd.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Java\\wininit.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Journal\\it-IT\\smss.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Adobe\\Acrobat\\csrss.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Adobe\\Acrobat\\csrss.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\3ca42062-bc30-11ec-af8e-f2122c6314cc\\winlogon.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\lsass.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\lsass.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Java\\wininit.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Journal\\it-IT\\smss.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\3ca42062-bc30-11ec-af8e-f2122c6314cc\\winlogon.exe\""	Portsurrogatehost.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Java\wininit.exe	Portsurrogatehost.exe
File created	C:\Program Files\Java\56085415360792	Portsurrogatehost.exe
File created	C:\Program Files\Windows Journal\it-IT\smss.exe	Portsurrogatehost.exe
File created	C:\Program Files\Windows Journal\it-IT\69ddcba757bf72	Portsurrogatehost.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe	Portsurrogatehost.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe	Portsurrogatehost.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\6203df4a6bafc7	Portsurrogatehost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1776	schtasks.exe
2020	schtasks.exe
1112	schtasks.exe
1548	schtasks.exe
976	schtasks.exe
1284	schtasks.exe
1628	schtasks.exe
1512	schtasks.exe
1752	schtasks.exe
1880	schtasks.exe
1636	schtasks.exe
1372	schtasks.exe
1376	schtasks.exe
1324	schtasks.exe
1624	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1396	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2044	Portsurrogatehost.exe
1300	csrss.exe
1300	csrss.exe
1300	csrss.exe
1300	csrss.exe
1300	csrss.exe
1300	csrss.exe
1300	csrss.exe
1300	csrss.exe
1300	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	Portsurrogatehost.exe
Token: SeDebugPrivilege	1300	csrss.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 876	1672	DCRatBuild_Full.exe	28
PID 1672 wrote to memory of 876	1672	DCRatBuild_Full.exe	28
PID 1672 wrote to memory of 876	1672	DCRatBuild_Full.exe	28
PID 1672 wrote to memory of 876	1672	DCRatBuild_Full.exe	28
PID 1672 wrote to memory of 1988	1672	DCRatBuild_Full.exe	29
PID 1672 wrote to memory of 1988	1672	DCRatBuild_Full.exe	29
PID 1672 wrote to memory of 1988	1672	DCRatBuild_Full.exe	29
PID 1672 wrote to memory of 1988	1672	DCRatBuild_Full.exe	29
PID 876 wrote to memory of 1296	876	WScript.exe	30
PID 876 wrote to memory of 1296	876	WScript.exe	30
PID 876 wrote to memory of 1296	876	WScript.exe	30
PID 876 wrote to memory of 1296	876	WScript.exe	30
PID 1296 wrote to memory of 2044	1296	cmd.exe	32
PID 1296 wrote to memory of 2044	1296	cmd.exe	32
PID 1296 wrote to memory of 2044	1296	cmd.exe	32
PID 1296 wrote to memory of 2044	1296	cmd.exe	32
PID 2044 wrote to memory of 1300	2044	Portsurrogatehost.exe	49
PID 2044 wrote to memory of 1300	2044	Portsurrogatehost.exe	49
PID 2044 wrote to memory of 1300	2044	Portsurrogatehost.exe	49
PID 1296 wrote to memory of 1396	1296	cmd.exe	50
PID 1296 wrote to memory of 1396	1296	cmd.exe	50
PID 1296 wrote to memory of 1396	1296	cmd.exe	50
PID 1296 wrote to memory of 1396	1296	cmd.exe	50

C:\Users\Admin\AppData\Local\Temp\DCRatBuild_Full.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild_Full.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\blockrefCommon\f3eALabGJmbx2bkCsBaU.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\blockrefCommon\P9UyGj8fNPESmY.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe
      "C:\Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe"
      4⤵
      DcRat
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Users\All Users\Adobe\Acrobat\csrss.exe
        
        "C:\Users\All Users\Adobe\Acrobat\csrss.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1396
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\blockrefCommon\file.vbs"
  2⤵
  PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Java\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Journal\it-IT\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Journal\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Adobe\Acrobat\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Adobe\Acrobat\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\3ca42062-bc30-11ec-af8e-f2122c6314cc\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\3ca42062-bc30-11ec-af8e-f2122c6314cc\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\3ca42062-bc30-11ec-af8e-f2122c6314cc\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\ProgramData\Adobe\Acrobat\csrss.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

P9UyGj8fNPESmY.bat

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\P9UyGj8fNPESmY.bat
Size 157B
SHA256 eecd17242cee9f4812a9e61f189e4c43c78c595690e72a937d8287dce5563cb9
MD5 fe92c67b33319fc2ecde0fe57b7b2fe9
SHA1 db182d6f5a2608c0e70d654003f067abc3e0314f
SHA512 06d2b9ffed881519ecf4d518d96e6a4e77523cfebd4b64751882f72196e8c9eb159f0af4fc55d8c74f133ab440a2296a054497e6afc6dfb4d772015fdd4d70f6
MD5 SHA1 SHA512

Submit Download

Portsurrogatehost.exe

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Portsurrogatehost.exe

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3eALabGJmbx2bkCsBaU.vbe

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\f3eALabGJmbx2bkCsBaU.vbe
Size 209B
SHA256 3916307bef91035d352655d3110d533904e3946c309c3497e35096e7156f0136
MD5 b3e36e507dff72bf78a0248f33d7d322
SHA1 a99ac0601fc2f7f2e7777e4310ef896b2b5f3b8e
SHA512 15f5605225aec0af68c205340c0a0a045d37e6864e0d1869f0c69502d7dc7559580b85fc0f0b842a384bc10e7cd2fd4ea672838d6c3f33075072e9b662440de0
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

csrss.exe

Path C:\Users\All Users\Adobe\Acrobat\csrss.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Portsurrogatehost.exe

Path \Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Portsurrogatehost.exe

Path \Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1300-80-0x0000000000390000-0x00000000003E6000-memory.dmp

Download

memory/1300-78-0x0000000000D20000-0x0000000000F64000-memory.dmp

Download

memory/1672-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Download

memory/2044-68-0x00000000000A0000-0x00000000002E4000-memory.dmp

Download

memory/2044-74-0x0000000000830000-0x0000000000838000-memory.dmp

Download

memory/2044-73-0x0000000000820000-0x000000000082E000-memory.dmp

Download

memory/2044-72-0x00000000007F0000-0x0000000000802000-memory.dmp

Download

memory/2044-71-0x00000000007A0000-0x00000000007F6000-memory.dmp

Download

memory/2044-70-0x0000000000790000-0x00000000007A0000-memory.dmp

Download

memory/2044-69-0x0000000000770000-0x000000000078C000-memory.dmp

Download