dcrat | dccd3eab40a7320e2d30eabd3bdb5ee0ba29d16176e73f4adf34e3158d50eef8

Analysis

max time kernel
128s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07/07/2022, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DCRatBuild_Full.exe
Size 2.5MB
Sample220707-vypebseee3
SHA256 dccd3eab40a7320e2d30eabd3bdb5ee0ba29d16176e73f4adf34e3158d50eef8
MD5 33cd2f1c0f4310d8f0f8213db3bb5d33
SHA1 83d613769d870049c41b653a0483a7e6cbce7a33
SHA512 59e9b115ff8be09d1cabc4b49d46c3a911c1e17f48eb698b7238cddfd31e8f69fa20dc63ee0414da267421f7180d2556bd2fc8c17901dae557e3923a4fa3321c
MD5 SHA1 SHA512

Score

10^/10

dcrat evasion infostealer persistence rat suricata

Malware Config

Signatures

DcRat 22 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4700	schtasks.exe
		3552	schtasks.exe
		3540	schtasks.exe
		1072	schtasks.exe
		5008	schtasks.exe
		4192	schtasks.exe
		368	schtasks.exe
		228	schtasks.exe
		3404	schtasks.exe
		4816	schtasks.exe
		3488	schtasks.exe
		1256	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation		DCRatBuild_Full.exe
		3188	schtasks.exe
		3656	schtasks.exe
		3496	schtasks.exe
		912	schtasks.exe
		4064	schtasks.exe
		2016	schtasks.exe
		2128	schtasks.exe
		3852	schtasks.exe
		4444	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Offline Web Pages\\csrss.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Windows\\Help\\Help\\taskhostw.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Windows\\Help\\Help\\taskhostw.exe\", \"C:\\Users\\Public\\Pictures\\dllhost.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Windows\\Help\\Help\\taskhostw.exe\", \"C:\\Users\\Public\\Pictures\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Windows\\Help\\Help\\taskhostw.exe\", \"C:\\Users\\Public\\Pictures\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Windows\\Help\\Help\\taskhostw.exe\", \"C:\\Users\\Public\\Pictures\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\dwm.exe\""	Portsurrogatehost.exe

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	5112	schtasks.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	5112	schtasks.exe	19

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000022ed2-138.dat	dcrat
behavioral2/files/0x0006000000022ed2-137.dat	dcrat
behavioral2/memory/1804-139-0x00000000006B0000-0x00000000008F4000-memory.dmp	dcrat
behavioral2/files/0x0007000000022ed6-149.dat	dcrat
behavioral2/files/0x0007000000022ed6-150.dat	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
1804	Portsurrogatehost.exe
1676	RuntimeBroker.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	DCRatBuild_Full.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Portsurrogatehost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\odt\\dwm.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Offline Web Pages\\csrss.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Help\\Help\\taskhostw.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Help\\Help\\taskhostw.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\Pictures\\dllhost.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Offline Web Pages\\csrss.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\Pictures\\dllhost.exe\""	Portsurrogatehost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\odt\\dwm.exe\""	Portsurrogatehost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\csrss.exe	Portsurrogatehost.exe
File created	C:\Windows\Offline Web Pages\886983d96e3d3e	Portsurrogatehost.exe
File created	C:\Windows\Help\Help\taskhostw.exe	Portsurrogatehost.exe
File created	C:\Windows\Help\Help\ea9f0e6c9e2dcd	Portsurrogatehost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3496	schtasks.exe
2016	schtasks.exe
3404	schtasks.exe
3188	schtasks.exe
4700	schtasks.exe
2128	schtasks.exe
3552	schtasks.exe
3540	schtasks.exe
4444	schtasks.exe
228	schtasks.exe
4816	schtasks.exe
1072	schtasks.exe
5008	schtasks.exe
368	schtasks.exe
4064	schtasks.exe
4192	schtasks.exe
3852	schtasks.exe
3656	schtasks.exe
3488	schtasks.exe
1256	schtasks.exe
912	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	DCRatBuild_Full.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	Portsurrogatehost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3140	reg.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1804	Portsurrogatehost.exe
1804	Portsurrogatehost.exe
1804	Portsurrogatehost.exe
1676	RuntimeBroker.exe
1676	RuntimeBroker.exe
1676	RuntimeBroker.exe
1676	RuntimeBroker.exe
1676	RuntimeBroker.exe
1676	RuntimeBroker.exe
1676	RuntimeBroker.exe
1676	RuntimeBroker.exe
1676	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1676	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	Portsurrogatehost.exe
Token: SeDebugPrivilege	1676	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4108	4256	DCRatBuild_Full.exe	82
PID 4256 wrote to memory of 4108	4256	DCRatBuild_Full.exe	82
PID 4256 wrote to memory of 4108	4256	DCRatBuild_Full.exe	82
PID 4256 wrote to memory of 1420	4256	DCRatBuild_Full.exe	83
PID 4256 wrote to memory of 1420	4256	DCRatBuild_Full.exe	83
PID 4256 wrote to memory of 1420	4256	DCRatBuild_Full.exe	83
PID 4108 wrote to memory of 4752	4108	WScript.exe	84
PID 4108 wrote to memory of 4752	4108	WScript.exe	84
PID 4108 wrote to memory of 4752	4108	WScript.exe	84
PID 4752 wrote to memory of 1804	4752	cmd.exe	86
PID 4752 wrote to memory of 1804	4752	cmd.exe	86
PID 1804 wrote to memory of 1604	1804	Portsurrogatehost.exe	111
PID 1804 wrote to memory of 1604	1804	Portsurrogatehost.exe	111
PID 1604 wrote to memory of 4240	1604	cmd.exe	113
PID 1604 wrote to memory of 4240	1604	cmd.exe	113
PID 4752 wrote to memory of 3140	4752	cmd.exe	114
PID 4752 wrote to memory of 3140	4752	cmd.exe	114
PID 4752 wrote to memory of 3140	4752	cmd.exe	114
PID 1604 wrote to memory of 1676	1604	cmd.exe	118
PID 1604 wrote to memory of 1676	1604	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\DCRatBuild_Full.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild_Full.exe"
1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\blockrefCommon\f3eALabGJmbx2bkCsBaU.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\blockrefCommon\P9UyGj8fNPESmY.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe
      "C:\Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Checks computer location settings
      Adds Run key to start application
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1804
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bI3xgQSjiv.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1604
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4240
      - C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3140
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\blockrefCommon\file.vbs"
  2⤵
  PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\Help\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Help\Help\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\Help\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\odt\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Recovery\WindowsRE\RuntimeBroker.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Recovery\WindowsRE\RuntimeBroker.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

bI3xgQSjiv.bat

Path C:\Users\Admin\AppData\Local\Temp\bI3xgQSjiv.bat
Size 204B
SHA256 47c96581a52dc578f64aaad0344b7ac4e3af212630c29f70cbacfa9a90f2dd02
MD5 19d28076f545ede553b7d15afedbe40b
SHA1 64ed0574b42a19f2fd0e66e26410dad1e44d6c6e
SHA512 6c0006e977a37c1535dbe5edef62b57bb253ac0a51d1b09dbcada47986d9c24924b957cd7a65d240bdad6edf49b327af6dc125f9c6fef167516e68ccd9b9d588
MD5 SHA1 SHA512

Submit Download

P9UyGj8fNPESmY.bat

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\P9UyGj8fNPESmY.bat
Size 157B
SHA256 eecd17242cee9f4812a9e61f189e4c43c78c595690e72a937d8287dce5563cb9
MD5 fe92c67b33319fc2ecde0fe57b7b2fe9
SHA1 db182d6f5a2608c0e70d654003f067abc3e0314f
SHA512 06d2b9ffed881519ecf4d518d96e6a4e77523cfebd4b64751882f72196e8c9eb159f0af4fc55d8c74f133ab440a2296a054497e6afc6dfb4d772015fdd4d70f6
MD5 SHA1 SHA512

Submit Download

Portsurrogatehost.exe

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Portsurrogatehost.exe

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\Portsurrogatehost.exe
Size 2.2MB
SHA256 1aa5b51d990d7a1a56b5a4181678633fbe02c77154f2fcd865f670b5fafc8612
MD5 2742de95257c6004267e9d6e516a03f7
SHA1 f55e1efe74dd1ee356ba637203e71ed5b71b07ee
SHA512 1f2c7677b8074771e416061ed617c431a0f1bbc7172861efd1c52ace31249b70351b2fd5b5c704c3ed7f5a81d980633d39ccfeafe87e122ac8de389912320400
SSDEEP 49152:jpa43sY3RuNKYxY5EVGiuINPttj0i3GJpJx:Nfd3RuN925wtjJ2JpJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3eALabGJmbx2bkCsBaU.vbe

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\f3eALabGJmbx2bkCsBaU.vbe
Size 209B
SHA256 3916307bef91035d352655d3110d533904e3946c309c3497e35096e7156f0136
MD5 b3e36e507dff72bf78a0248f33d7d322
SHA1 a99ac0601fc2f7f2e7777e4310ef896b2b5f3b8e
SHA512 15f5605225aec0af68c205340c0a0a045d37e6864e0d1869f0c69502d7dc7559580b85fc0f0b842a384bc10e7cd2fd4ea672838d6c3f33075072e9b662440de0
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Local\Temp\blockrefCommon\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

memory/1676-152-0x00007FFA8C4A0000-0x00007FFA8CF61000-memory.dmp

Download

memory/1676-151-0x00007FFA8C4A0000-0x00007FFA8CF61000-memory.dmp

Download

memory/1804-140-0x00007FFA8C570000-0x00007FFA8D031000-memory.dmp

Download

memory/1804-145-0x00007FFA8C570000-0x00007FFA8D031000-memory.dmp

Download

memory/1804-142-0x000000001CBF0000-0x000000001D118000-memory.dmp

Download

memory/1804-141-0x0000000002B10000-0x0000000002B60000-memory.dmp

Download

memory/1804-139-0x00000000006B0000-0x00000000008F4000-memory.dmp

Download