dcrat | b82f23ee8617e7ad47d7513fe175e7211564eed5442002927a415d7a035da5cf

Resubmissions

26-12-2022 00:04

221226-acrmcafe2y 10

26-12-2022 00:03

26-12-2022 00:03

26-12-2022 00:03

26-12-2022 00:02

26-12-2022 00:01

Analysis

max time kernel
14s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-12-2022 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b74a99460e2b8051d917c392d1079a646435188b84d6998afed2c458bf83a69.exe
Size

1.3MB
MD5

e1e945f04fbbeab2efa06d16d21e4c22
SHA1

54037b5b03272d255ab875b5791f87902c5b9457
SHA256

0b74a99460e2b8051d917c392d1079a646435188b84d6998afed2c458bf83a69
SHA512

61dfbe4d1803ba11f7318b1338343529be925bd84ba107bccb9d7c3f8175a012ea877a613946419f8486cd1c1606d7433c07342278a8c670a5013e999308ae41
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	1568	schtasks.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral2/memory/764-65-0x0000000001380000-0x0000000001490000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

DllCommonsvc.exe

pid process

764 DllCommonsvc.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

268 cmd.exe
268 cmd.exe

pid	process
764	DllCommonsvc.exe

pid	process
268	cmd.exe
268	cmd.exe

Drops file in Program Files directory 5 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\dwm.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Uninstall Information\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\csrss.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\debug\WIA\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\debug\WIA\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\Tasks\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\Tasks\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\Resources\Themes\Aero\en-US\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Resources\Themes\Aero\en-US\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1916	schtasks.exe
1376	schtasks.exe
1140	schtasks.exe
1688	schtasks.exe
1636	schtasks.exe
1136	schtasks.exe
1840	schtasks.exe
888	schtasks.exe
1964	schtasks.exe
2024	schtasks.exe
1956	schtasks.exe
1960	schtasks.exe
900	schtasks.exe
1464	schtasks.exe
1928	schtasks.exe
884	schtasks.exe
1184	schtasks.exe
432	schtasks.exe
964	schtasks.exe
1720	schtasks.exe
1276	schtasks.exe
568	schtasks.exe
916	schtasks.exe
1496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

DllCommonsvc.exe

pid process

764 DllCommonsvc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DllCommonsvc.exe

description pid process

Token: SeDebugPrivilege 764 DllCommonsvc.exe

pid	process
764	DllCommonsvc.exe

description	pid	process
Token: SeDebugPrivilege	764	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

0b74a99460e2b8051d917c392d1079a646435188b84d6998afed2c458bf83a69.exeWScript.execmd.exeDllCommonsvc.exe

description	pid	process	target process
PID 948 wrote to memory of 1140	948	0b74a99460e2b8051d917c392d1079a646435188b84d6998afed2c458bf83a69.exe	WScript.exe
PID 948 wrote to memory of 1140	948	0b74a99460e2b8051d917c392d1079a646435188b84d6998afed2c458bf83a69.exe	WScript.exe
PID 948 wrote to memory of 1140	948	0b74a99460e2b8051d917c392d1079a646435188b84d6998afed2c458bf83a69.exe	WScript.exe
PID 948 wrote to memory of 1140	948	0b74a99460e2b8051d917c392d1079a646435188b84d6998afed2c458bf83a69.exe	WScript.exe
PID 1140 wrote to memory of 268	1140	WScript.exe	cmd.exe
PID 1140 wrote to memory of 268	1140	WScript.exe	cmd.exe
PID 1140 wrote to memory of 268	1140	WScript.exe	cmd.exe
PID 1140 wrote to memory of 268	1140	WScript.exe	cmd.exe
PID 268 wrote to memory of 764	268	cmd.exe	DllCommonsvc.exe
PID 268 wrote to memory of 764	268	cmd.exe	DllCommonsvc.exe
PID 268 wrote to memory of 764	268	cmd.exe	DllCommonsvc.exe
PID 268 wrote to memory of 764	268	cmd.exe	DllCommonsvc.exe
PID 764 wrote to memory of 1280	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1280	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1280	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 328	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 328	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 328	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 2012	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 2012	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 2012	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1380	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1380	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1380	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1724	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1724	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1724	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 528	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 528	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 528	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1592	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1592	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1592	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1136	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1136	764	DllCommonsvc.exe	powershell.exe
PID 764 wrote to memory of 1136	764	DllCommonsvc.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\0b74a99460e2b8051d917c392d1079a646435188b84d6998afed2c458bf83a69.exe
"C:\Users\Admin\AppData\Local\Temp\0b74a99460e2b8051d917c392d1079a646435188b84d6998afed2c458bf83a69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
PID:1280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\dwm.exe'
5⤵
PID:328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\lsass.exe'
5⤵
PID:2012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
5⤵
PID:1724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SendTo\Idle.exe'
5⤵
PID:1380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\Aero\en-US\csrss.exe'
5⤵
PID:528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\ja-JP\csrss.exe'
5⤵
PID:1592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\WIA\lsm.exe'
5⤵
PID:1136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\spoolsv.exe'
5⤵
PID:1312

C:\Users\Admin\SendTo\Idle.exe
"C:\Users\Admin\SendTo\Idle.exe"
5⤵
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Application Data\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Application Data\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\SendTo\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\SendTo\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Resources\Themes\Aero\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\Aero\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Resources\Themes\Aero\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Windows\debug\WIA\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\debug\WIA\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\debug\WIA\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Tasks\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\Tasks\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1e70334627f1cd70cee45d20ff830719

SHA1
5d2693fc3cb4dfccaa76e86ee8ea59a3eecbe8af

SHA256
1c473e8036cf6e69ffbdeb1554f0f981018aa22b53e14b9ee1847b86e9903448

SHA512
4965874cd29ac13abba76c716c9a7acc3a6892d5a8c123b4a965dabec66b4dc31d8aeb48464800b27fddc80c7c147c3ed78aa196e980fee15714b5bad38cb89e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1e70334627f1cd70cee45d20ff830719

SHA1
5d2693fc3cb4dfccaa76e86ee8ea59a3eecbe8af

SHA256
1c473e8036cf6e69ffbdeb1554f0f981018aa22b53e14b9ee1847b86e9903448

SHA512
4965874cd29ac13abba76c716c9a7acc3a6892d5a8c123b4a965dabec66b4dc31d8aeb48464800b27fddc80c7c147c3ed78aa196e980fee15714b5bad38cb89e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1e70334627f1cd70cee45d20ff830719

SHA1
5d2693fc3cb4dfccaa76e86ee8ea59a3eecbe8af

SHA256
1c473e8036cf6e69ffbdeb1554f0f981018aa22b53e14b9ee1847b86e9903448

SHA512
4965874cd29ac13abba76c716c9a7acc3a6892d5a8c123b4a965dabec66b4dc31d8aeb48464800b27fddc80c7c147c3ed78aa196e980fee15714b5bad38cb89e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1e70334627f1cd70cee45d20ff830719

SHA1
5d2693fc3cb4dfccaa76e86ee8ea59a3eecbe8af

SHA256
1c473e8036cf6e69ffbdeb1554f0f981018aa22b53e14b9ee1847b86e9903448

SHA512
4965874cd29ac13abba76c716c9a7acc3a6892d5a8c123b4a965dabec66b4dc31d8aeb48464800b27fddc80c7c147c3ed78aa196e980fee15714b5bad38cb89e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1e70334627f1cd70cee45d20ff830719

SHA1
5d2693fc3cb4dfccaa76e86ee8ea59a3eecbe8af

SHA256
1c473e8036cf6e69ffbdeb1554f0f981018aa22b53e14b9ee1847b86e9903448

SHA512
4965874cd29ac13abba76c716c9a7acc3a6892d5a8c123b4a965dabec66b4dc31d8aeb48464800b27fddc80c7c147c3ed78aa196e980fee15714b5bad38cb89e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1e70334627f1cd70cee45d20ff830719

SHA1
5d2693fc3cb4dfccaa76e86ee8ea59a3eecbe8af

SHA256
1c473e8036cf6e69ffbdeb1554f0f981018aa22b53e14b9ee1847b86e9903448

SHA512
4965874cd29ac13abba76c716c9a7acc3a6892d5a8c123b4a965dabec66b4dc31d8aeb48464800b27fddc80c7c147c3ed78aa196e980fee15714b5bad38cb89e

Download Submit
C:\providercommon\1zu9dW.bat
Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/268-59-0x0000000000000000-mapping.dmp

Download
memory/328-77-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

Filesize
8KB

Download
memory/328-111-0x000007FEEBB50000-0x000007FEEC6AD000-memory.dmp

Filesize
11.4MB

Download
memory/328-113-0x000000001B820000-0x000000001BB1F000-memory.dmp

Filesize
3.0MB

Download
memory/328-116-0x00000000022BB000-0x00000000022DA000-memory.dmp

Filesize
124KB

Download
memory/328-108-0x00000000022B4000-0x00000000022B7000-memory.dmp

Filesize
12KB

Download
memory/328-71-0x0000000000000000-mapping.dmp

Download
memory/328-82-0x000007FEEC6B0000-0x000007FEED0D3000-memory.dmp

Filesize
10.1MB

Download
memory/528-75-0x0000000000000000-mapping.dmp

Download
memory/764-63-0x0000000000000000-mapping.dmp

Download
memory/764-69-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/764-68-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/764-67-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download
memory/764-66-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/764-65-0x0000000001380000-0x0000000001490000-memory.dmp

Filesize
1.1MB

Download
memory/948-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1136-105-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1136-115-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1136-102-0x000007FEEBB50000-0x000007FEEC6AD000-memory.dmp

Filesize
11.4MB

Download
memory/1136-114-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/1136-101-0x000007FEEC6B0000-0x000007FEED0D3000-memory.dmp

Filesize
10.1MB

Download
memory/1136-78-0x0000000000000000-mapping.dmp

Download
memory/1140-55-0x0000000000000000-mapping.dmp

Download
memory/1280-97-0x000007FEEC6B0000-0x000007FEED0D3000-memory.dmp

Filesize
10.1MB

Download
memory/1280-125-0x00000000023CB000-0x00000000023EA000-memory.dmp

Filesize
124KB

Download
memory/1280-70-0x0000000000000000-mapping.dmp

Download
memory/1280-124-0x00000000023C4000-0x00000000023C7000-memory.dmp

Filesize
12KB

Download
memory/1280-118-0x000000001B890000-0x000000001BB8F000-memory.dmp

Filesize
3.0MB

Download
memory/1280-109-0x000007FEEBB50000-0x000007FEEC6AD000-memory.dmp

Filesize
11.4MB

Download
memory/1312-128-0x0000000002404000-0x0000000002407000-memory.dmp

Filesize
12KB

Download
memory/1312-112-0x000007FEEBB50000-0x000007FEEC6AD000-memory.dmp

Filesize
11.4MB

Download
memory/1312-119-0x000000001B8A0000-0x000000001BB9F000-memory.dmp

Filesize
3.0MB

Download
memory/1312-99-0x000007FEEC6B0000-0x000007FEED0D3000-memory.dmp

Filesize
10.1MB

Download
memory/1312-81-0x0000000000000000-mapping.dmp

Download
memory/1312-130-0x000000000240B000-0x000000000242A000-memory.dmp

Filesize
124KB

Download
memory/1380-73-0x0000000000000000-mapping.dmp

Download
memory/1380-107-0x00000000021D4000-0x00000000021D7000-memory.dmp

Filesize
12KB

Download
memory/1380-126-0x00000000021D4000-0x00000000021D7000-memory.dmp

Filesize
12KB

Download
memory/1380-127-0x00000000021DB000-0x00000000021FA000-memory.dmp

Filesize
124KB

Download
memory/1380-104-0x000007FEEBB50000-0x000007FEEC6AD000-memory.dmp

Filesize
11.4MB

Download
memory/1380-98-0x000007FEEC6B0000-0x000007FEED0D3000-memory.dmp

Filesize
10.1MB

Download
memory/1380-120-0x000000001B7B0000-0x000000001BAAF000-memory.dmp

Filesize
3.0MB

Download
memory/1592-121-0x000000001B990000-0x000000001BC8F000-memory.dmp

Filesize
3.0MB

Download
memory/1592-129-0x00000000028F4000-0x00000000028F7000-memory.dmp

Filesize
12KB

Download
memory/1592-106-0x00000000028F4000-0x00000000028F7000-memory.dmp

Filesize
12KB

Download
memory/1592-103-0x000007FEEBB50000-0x000007FEEC6AD000-memory.dmp

Filesize
11.4MB

Download
memory/1592-100-0x000007FEEC6B0000-0x000007FEED0D3000-memory.dmp

Filesize
10.1MB

Download
memory/1592-76-0x0000000000000000-mapping.dmp

Download
memory/1592-131-0x00000000028FB000-0x000000000291A000-memory.dmp

Filesize
124KB

Download
memory/1724-74-0x0000000000000000-mapping.dmp

Download
memory/2012-123-0x00000000025B4000-0x00000000025B7000-memory.dmp

Filesize
12KB

Download
memory/2012-117-0x000000001BA00000-0x000000001BCFF000-memory.dmp

Filesize
3.0MB

Download
memory/2012-122-0x00000000025BB000-0x00000000025DA000-memory.dmp

Filesize
124KB

Download
memory/2012-110-0x000007FEEBB50000-0x000007FEEC6AD000-memory.dmp

Filesize
11.4MB

Download
memory/2012-84-0x000007FEEC6B0000-0x000007FEED0D3000-memory.dmp

Filesize
10.1MB

Download
memory/2012-72-0x0000000000000000-mapping.dmp

Download
memory/2184-89-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads