dcrat | a0df043771d7abc922ee467a92bad5e31001e36f978b5d56e415e853cba7f761

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/01/2023, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Size 2.8MB
Sample230102-qhsplaed25
SHA256 a0df043771d7abc922ee467a92bad5e31001e36f978b5d56e415e853cba7f761
MD5 cefe39ab766debcfb1a3850e6036fab8
SHA1 586dcb5e89002e373d1767e3c0e1b57795c64f7e
SHA512 fa1f8e0386cb39a813d2e6aa48b743c745fb47e86a390f82df7154a35135d6a610a1737b810e859f8709cba1b4da3e6e54ed173034cab59fcecb1becebb5e8f7
SSDEEP 49152:qjxo0D7Ya47v8YAl5sxk744fSpqtpsGMLlMFFQvigDy/nqOMAAz1qYszS:e60D7YbAl4ZpWs2FKKXnVMAAz1N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 32 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		984	schtasks.exe
		520	schtasks.exe
		1536	schtasks.exe
		1920	schtasks.exe
		1312	schtasks.exe
		1552	schtasks.exe
		744	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		CEFE39AB766DEBCFB1A3850E6036FAB8.exe
		1516	schtasks.exe
		1548	schtasks.exe
		1456	schtasks.exe
		924	schtasks.exe
		1492	schtasks.exe
		304	schtasks.exe
		1476	schtasks.exe
		1416	schtasks.exe
		1828	schtasks.exe
		1072	schtasks.exe
		860	schtasks.exe
		1968	schtasks.exe
		1184	schtasks.exe
		1180	schtasks.exe
		1488	schtasks.exe
		632	schtasks.exe
		588	schtasks.exe
File created	C:\Program Files\Google\Chrome\Application\c5b4cb5e9653cc		CEFE39AB766DEBCFB1A3850E6036FAB8.exe
		1708	schtasks.exe
		1656	schtasks.exe
		668	schtasks.exe
		1904	schtasks.exe
		1208	schtasks.exe
		1684	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\", \"C:\\Users\\Admin\\Recent\\wininit.exe\", \"C:\\Users\\Default\\Cookies\\csrss.exe\", \"C:\\Windows\\TAPI\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\CEFE39AB766DEBCFB1A3850E6036FAB8.exe\", \"C:\\Program Files\\Java\\lsm.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\System.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\", \"C:\\Users\\Admin\\Recent\\wininit.exe\", \"C:\\Users\\Default\\Cookies\\csrss.exe\", \"C:\\Windows\\TAPI\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\CEFE39AB766DEBCFB1A3850E6036FAB8.exe\", \"C:\\Program Files\\Java\\lsm.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\System.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ja\\dwm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\", \"C:\\Users\\Admin\\Recent\\wininit.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\", \"C:\\Users\\Admin\\Recent\\wininit.exe\", \"C:\\Users\\Default\\Cookies\\csrss.exe\", \"C:\\Windows\\TAPI\\dwm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\", \"C:\\Users\\Admin\\Recent\\wininit.exe\", \"C:\\Users\\Default\\Cookies\\csrss.exe\", \"C:\\Windows\\TAPI\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\", \"C:\\Users\\Admin\\Recent\\wininit.exe\", \"C:\\Users\\Default\\Cookies\\csrss.exe\", \"C:\\Windows\\TAPI\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\CEFE39AB766DEBCFB1A3850E6036FAB8.exe\", \"C:\\Program Files\\Java\\lsm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\", \"C:\\Users\\Admin\\Recent\\wininit.exe\", \"C:\\Users\\Default\\Cookies\\csrss.exe\", \"C:\\Windows\\TAPI\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\CEFE39AB766DEBCFB1A3850E6036FAB8.exe\", \"C:\\Program Files\\Java\\lsm.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\", \"C:\\Users\\Admin\\Recent\\wininit.exe\", \"C:\\Users\\Default\\Cookies\\csrss.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\", \"C:\\Users\\Admin\\Recent\\wininit.exe\", \"C:\\Users\\Default\\Cookies\\csrss.exe\", \"C:\\Windows\\TAPI\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\CEFE39AB766DEBCFB1A3850E6036FAB8.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	520	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	336	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	336	schtasks.exe	27

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2024-54-0x0000000000230000-0x0000000000510000-memory.dmp	dcrat
behavioral1/files/0x000500000000b2d2-74.dat	dcrat
behavioral1/files/0x000500000000b2d2-75.dat	dcrat
behavioral1/memory/1728-76-0x0000000000360000-0x0000000000640000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1728	services.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\TAPI\\dwm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Java\\lsm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\System.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ja\\dwm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Admin\\Recent\\wininit.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Cookies\\csrss.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CEFE39AB766DEBCFB1A3850E6036FAB8 = "\"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\CEFE39AB766DEBCFB1A3850E6036FAB8.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\System.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Admin\\Recent\\wininit.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Cookies\\csrss.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\TAPI\\dwm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ja\\dwm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Google\\Chrome\\Application\\services.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\CEFE39AB766DEBCFB1A3850E6036FAB8 = "\"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\CEFE39AB766DEBCFB1A3850E6036FAB8.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Java\\lsm.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\Idle.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\de-DE\Idle.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\dwm.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\services.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Google\Chrome\Application\c5b4cb5e9653cc	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Java\101b941d020240	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\6cb0b6c459d5d3	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Google\Chrome\Application\services.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Java\lsm.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\6ccacd8608530f	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\TAPI\dwm.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Windows\TAPI\6cb0b6c459d5d3	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1904	schtasks.exe
860	schtasks.exe
1656	schtasks.exe
1492	schtasks.exe
1548	schtasks.exe
1552	schtasks.exe
1708	schtasks.exe
304	schtasks.exe
1072	schtasks.exe
984	schtasks.exe
1184	schtasks.exe
1456	schtasks.exe
744	schtasks.exe
1516	schtasks.exe
632	schtasks.exe
1920	schtasks.exe
1828	schtasks.exe
1684	schtasks.exe
520	schtasks.exe
1968	schtasks.exe
588	schtasks.exe
1476	schtasks.exe
924	schtasks.exe
1416	schtasks.exe
1536	schtasks.exe
1312	schtasks.exe
1208	schtasks.exe
1180	schtasks.exe
1488	schtasks.exe
668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2024	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
1728	services.exe
1728	services.exe
1728	services.exe
1728	services.exe
1728	services.exe
1728	services.exe
1728	services.exe
1728	services.exe
1728	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Token: SeDebugPrivilege	1728	services.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1728	2024	CEFE39AB766DEBCFB1A3850E6036FAB8.exe	58
PID 2024 wrote to memory of 1728	2024	CEFE39AB766DEBCFB1A3850E6036FAB8.exe	58
PID 2024 wrote to memory of 1728	2024	CEFE39AB766DEBCFB1A3850E6036FAB8.exe	58
PID 1728 wrote to memory of 768	1728	services.exe	59
PID 1728 wrote to memory of 768	1728	services.exe	59
PID 1728 wrote to memory of 768	1728	services.exe	59
PID 1728 wrote to memory of 1464	1728	services.exe	60
PID 1728 wrote to memory of 1464	1728	services.exe	60
PID 1728 wrote to memory of 1464	1728	services.exe	60

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

C:\Users\Admin\AppData\Local\Temp\CEFE39AB766DEBCFB1A3850E6036FAB8.exe
"C:\Users\Admin\AppData\Local\Temp\CEFE39AB766DEBCFB1A3850E6036FAB8.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2024
- C:\Program Files\Google\Chrome\Application\services.exe
  "C:\Program Files\Google\Chrome\Application\services.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1728
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e31d6d5-0c73-4285-9f29-a106006e8f4d.vbs"
    3⤵
    PID:768
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3b5b76b-7cad-4b96-8af8-7de96a2f9ef0.vbs"
    3⤵
    PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\Application\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Recent\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\Recent\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Recent\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Cookies\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Cookies\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Cookies\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\TAPI\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "CEFE39AB766DEBCFB1A3850E6036FAB8C" /sc MINUTE /mo 10 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\CEFE39AB766DEBCFB1A3850E6036FAB8.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "CEFE39AB766DEBCFB1A3850E6036FAB8" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\CEFE39AB766DEBCFB1A3850E6036FAB8.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "CEFE39AB766DEBCFB1A3850E6036FAB8C" /sc MINUTE /mo 13 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\CEFE39AB766DEBCFB1A3850E6036FAB8.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Java\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\Program Files\Google\Chrome\Application\services.exe
Size 2.8MB
SHA256 a0df043771d7abc922ee467a92bad5e31001e36f978b5d56e415e853cba7f761
MD5 cefe39ab766debcfb1a3850e6036fab8
SHA1 586dcb5e89002e373d1767e3c0e1b57795c64f7e
SHA512 fa1f8e0386cb39a813d2e6aa48b743c745fb47e86a390f82df7154a35135d6a610a1737b810e859f8709cba1b4da3e6e54ed173034cab59fcecb1becebb5e8f7
SSDEEP 49152:qjxo0D7Ya47v8YAl5sxk744fSpqtpsGMLlMFFQvigDy/nqOMAAz1qYszS:e60D7YbAl4ZpWs2FKKXnVMAAz1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\Program Files\Google\Chrome\Application\services.exe
Size 2.8MB
SHA256 a0df043771d7abc922ee467a92bad5e31001e36f978b5d56e415e853cba7f761
MD5 cefe39ab766debcfb1a3850e6036fab8
SHA1 586dcb5e89002e373d1767e3c0e1b57795c64f7e
SHA512 fa1f8e0386cb39a813d2e6aa48b743c745fb47e86a390f82df7154a35135d6a610a1737b810e859f8709cba1b4da3e6e54ed173034cab59fcecb1becebb5e8f7
SSDEEP 49152:qjxo0D7Ya47v8YAl5sxk744fSpqtpsGMLlMFFQvigDy/nqOMAAz1qYszS:e60D7YbAl4ZpWs2FKKXnVMAAz1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

2e31d6d5-0c73-4285-9f29-a106006e8f4d.vbs

Path C:\Users\Admin\AppData\Local\Temp\2e31d6d5-0c73-4285-9f29-a106006e8f4d.vbs
Size 731B
SHA256 b0370258144f363ce9e7c1df12f4c4ad28a18e6c9923a04e7dac15ab0f7b2d25
MD5 f080f07c517800770e647d009f997f15
SHA1 9b492bb3a452fdac842a34d56367c3569385b0e6
SHA512 8047b0d63bf22bcffa5bc96b2dcf7457a54ed87933bfd01b331c349f317a4e289afc0b4de312c37069783648bcfc7534e6f397d33f432051a971a59209fa2f0a
MD5 SHA1 SHA512

Submit Download

e3b5b76b-7cad-4b96-8af8-7de96a2f9ef0.vbs

Path C:\Users\Admin\AppData\Local\Temp\e3b5b76b-7cad-4b96-8af8-7de96a2f9ef0.vbs
Size 507B
SHA256 2fe3636f0532ca018d28ed22442ce6214a316a1ae3b91e8511933ed714009080
MD5 b28739ecd411910c0fc4a60499c43618
SHA1 05f177a56769f4b16d3cc92209f73bcdbed61db3
SHA512 3fa3c77df497607f8020c866609561797760c31838fc61cbb1c6ad70bcbc100b209bb89bd37c979d73bec957e62ced0a24d7684109a12b2e5cbbff38be85c185
MD5 SHA1 SHA512

Submit Download

memory/1728-78-0x00000000008E0000-0x00000000008F2000-memory.dmp

Download

memory/1728-77-0x00000000006F0000-0x0000000000702000-memory.dmp

Download

memory/1728-76-0x0000000000360000-0x0000000000640000-memory.dmp

Download

memory/2024-61-0x0000000000710000-0x000000000071A000-memory.dmp

Download

memory/2024-64-0x0000000002220000-0x0000000002228000-memory.dmp

Download

memory/2024-66-0x00000000022C0000-0x00000000022D2000-memory.dmp

Download

memory/2024-67-0x0000000002480000-0x0000000002488000-memory.dmp

Download

memory/2024-68-0x000000001AA10000-0x000000001AA1A000-memory.dmp

Download

memory/2024-69-0x000000001AA20000-0x000000001AA2E000-memory.dmp

Download

memory/2024-71-0x000000001AA40000-0x000000001AA48000-memory.dmp

Download

memory/2024-70-0x000000001AA30000-0x000000001AA38000-memory.dmp

Download

memory/2024-72-0x000000001AA50000-0x000000001AA5C000-memory.dmp

Download

memory/2024-65-0x00000000022B0000-0x00000000022BC000-memory.dmp

Download

memory/2024-63-0x00000000007B0000-0x00000000007BC000-memory.dmp

Download

memory/2024-62-0x00000000021D0000-0x0000000002226000-memory.dmp

Download

memory/2024-54-0x0000000000230000-0x0000000000510000-memory.dmp

Download

memory/2024-60-0x00000000007A0000-0x00000000007B0000-memory.dmp

Download

memory/2024-59-0x0000000000700000-0x0000000000712000-memory.dmp

Download

memory/2024-58-0x00000000006E0000-0x00000000006F6000-memory.dmp

Download

memory/2024-57-0x0000000000650000-0x0000000000660000-memory.dmp

Download

memory/2024-56-0x0000000000630000-0x000000000064C000-memory.dmp

Download

memory/2024-55-0x0000000000620000-0x000000000062E000-memory.dmp

Download