dcrat | a0df043771d7abc922ee467a92bad5e31001e36f978b5d56e415e853cba7f761

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2023, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Size 2.8MB
Sample230102-qhsplaed25
SHA256 a0df043771d7abc922ee467a92bad5e31001e36f978b5d56e415e853cba7f761
MD5 cefe39ab766debcfb1a3850e6036fab8
SHA1 586dcb5e89002e373d1767e3c0e1b57795c64f7e
SHA512 fa1f8e0386cb39a813d2e6aa48b743c745fb47e86a390f82df7154a35135d6a610a1737b810e859f8709cba1b4da3e6e54ed173034cab59fcecb1becebb5e8f7
SSDEEP 49152:qjxo0D7Ya47v8YAl5sxk744fSpqtpsGMLlMFFQvigDy/nqOMAAz1qYszS:e60D7YbAl4ZpWs2FKKXnVMAAz1N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 19 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		100	schtasks.exe
		640	schtasks.exe
		4040	schtasks.exe
		3200	schtasks.exe
		3636	schtasks.exe
		3632	schtasks.exe
		3292	schtasks.exe
		3164	schtasks.exe
		116	schtasks.exe
		1316	schtasks.exe
		2324	schtasks.exe
		3780	schtasks.exe
		3360	schtasks.exe
		3612	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		CEFE39AB766DEBCFB1A3850E6036FAB8.exe
		3576	schtasks.exe
		60	schtasks.exe
		2884	schtasks.exe
		4332	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\System.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\System.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\Logs\\MeasuredBoot\\sppsvc.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\System.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\Logs\\MeasuredBoot\\sppsvc.exe\", \"C:\\Program Files\\Windows Mail\\WmiPrvSE.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\System.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\Logs\\MeasuredBoot\\sppsvc.exe\", \"C:\\Program Files\\Windows Mail\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\smss.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\System.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	2836	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	2836	schtasks.exe	68

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1572-132-0x0000000000CB0000-0x0000000000F90000-memory.dmp	dcrat
behavioral2/files/0x000600000002316b-141.dat	dcrat
behavioral2/files/0x000600000002316b-142.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
4676	WmiPrvSE.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Windows Sidebar\\System.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Logs\\MeasuredBoot\\sppsvc.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Internet Explorer\\smss.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Windows Sidebar\\System.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Logs\\MeasuredBoot\\sppsvc.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Mail\\WmiPrvSE.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Mail\\WmiPrvSE.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Internet Explorer\\smss.exe\""	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\smss.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Internet Explorer\69ddcba757bf72	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Windows Sidebar\System.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Windows Sidebar\27d1bcfc3c54e0	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Windows Mail\WmiPrvSE.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Program Files\Windows Mail\24dbde2999530e	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Logs\MeasuredBoot\0a1fd5f707cd16	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
File created	C:\Windows\Logs\MeasuredBoot\sppsvc.exe	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
116	schtasks.exe
2324	schtasks.exe
60	schtasks.exe
640	schtasks.exe
3636	schtasks.exe
3292	schtasks.exe
3200	schtasks.exe
4332	schtasks.exe
3612	schtasks.exe
1316	schtasks.exe
3360	schtasks.exe
3780	schtasks.exe
2884	schtasks.exe
3164	schtasks.exe
3576	schtasks.exe
100	schtasks.exe
4040	schtasks.exe
3632	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	WmiPrvSE.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1572	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
1572	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
1572	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
1572	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
1572	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
4676	WmiPrvSE.exe
4676	WmiPrvSE.exe
4676	WmiPrvSE.exe
4676	WmiPrvSE.exe
4676	WmiPrvSE.exe
4676	WmiPrvSE.exe
4676	WmiPrvSE.exe
4676	WmiPrvSE.exe
4676	WmiPrvSE.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4676	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Token: SeDebugPrivilege	4676	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4296	1572	CEFE39AB766DEBCFB1A3850E6036FAB8.exe	97
PID 1572 wrote to memory of 4296	1572	CEFE39AB766DEBCFB1A3850E6036FAB8.exe	97
PID 4296 wrote to memory of 2112	4296	cmd.exe	99
PID 4296 wrote to memory of 2112	4296	cmd.exe	99
PID 4296 wrote to memory of 4676	4296	cmd.exe	104
PID 4296 wrote to memory of 4676	4296	cmd.exe	104
PID 4676 wrote to memory of 3388	4676	WmiPrvSE.exe	107
PID 4676 wrote to memory of 3388	4676	WmiPrvSE.exe	107
PID 4676 wrote to memory of 4620	4676	WmiPrvSE.exe	108
PID 4676 wrote to memory of 4620	4676	WmiPrvSE.exe	108

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CEFE39AB766DEBCFB1A3850E6036FAB8.exe

C:\Users\Admin\AppData\Local\Temp\CEFE39AB766DEBCFB1A3850E6036FAB8.exe
"C:\Users\Admin\AppData\Local\Temp\CEFE39AB766DEBCFB1A3850E6036FAB8.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c9Hz5DPa6g.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2112
- - C:\Program Files\Windows Mail\WmiPrvSE.exe
    "C:\Program Files\Windows Mail\WmiPrvSE.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4676
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e41248d1-5b89-4423-8659-c245b5954959.vbs"
      4⤵
      PID:3388
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cea3bd62-5b5f-4976-a806-a1fc93b5e797.vbs"
      4⤵
      PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\Logs\MeasuredBoot\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Logs\MeasuredBoot\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\Logs\MeasuredBoot\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WmiPrvSE.exe

Path C:\Program Files\Windows Mail\WmiPrvSE.exe
Size 2.8MB
SHA256 a0df043771d7abc922ee467a92bad5e31001e36f978b5d56e415e853cba7f761
MD5 cefe39ab766debcfb1a3850e6036fab8
SHA1 586dcb5e89002e373d1767e3c0e1b57795c64f7e
SHA512 fa1f8e0386cb39a813d2e6aa48b743c745fb47e86a390f82df7154a35135d6a610a1737b810e859f8709cba1b4da3e6e54ed173034cab59fcecb1becebb5e8f7
SSDEEP 49152:qjxo0D7Ya47v8YAl5sxk744fSpqtpsGMLlMFFQvigDy/nqOMAAz1qYszS:e60D7YbAl4ZpWs2FKKXnVMAAz1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiPrvSE.exe

Path C:\Program Files\Windows Mail\WmiPrvSE.exe
Size 2.8MB
SHA256 a0df043771d7abc922ee467a92bad5e31001e36f978b5d56e415e853cba7f761
MD5 cefe39ab766debcfb1a3850e6036fab8
SHA1 586dcb5e89002e373d1767e3c0e1b57795c64f7e
SHA512 fa1f8e0386cb39a813d2e6aa48b743c745fb47e86a390f82df7154a35135d6a610a1737b810e859f8709cba1b4da3e6e54ed173034cab59fcecb1becebb5e8f7
SSDEEP 49152:qjxo0D7Ya47v8YAl5sxk744fSpqtpsGMLlMFFQvigDy/nqOMAAz1qYszS:e60D7YbAl4ZpWs2FKKXnVMAAz1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

c9Hz5DPa6g.bat

Path C:\Users\Admin\AppData\Local\Temp\c9Hz5DPa6g.bat
Size 207B
SHA256 84f2646f565dafd7c53b4d723bfccfd52161d0b971f5b53cf0ad3ec8234dbece
MD5 6d0668c6a43b9de05417e2b7c5bf194c
SHA1 802ee5a06a0adbd684469c12317a973a757adc97
SHA512 10287e6750b86cbef3818a64acf3a4b414d097da2436eec1c8aabf0e8225e4cac7eb178431c6dd64f061da8197278d8d64db59f67d8c04d536e4fa39394e6ac5
MD5 SHA1 SHA512

Submit Download

cea3bd62-5b5f-4976-a806-a1fc93b5e797.vbs

Path C:\Users\Admin\AppData\Local\Temp\cea3bd62-5b5f-4976-a806-a1fc93b5e797.vbs
Size 494B
SHA256 5abed28466c2fe49be83baa895602d4a8d10cc0025273a4ba8fd610bb9ef9cb5
MD5 0d47ee2c8c7ee7f4fc9f1f0c9c60fc0c
SHA1 8d47bb6720d2b009132cd962c59adcb596058724
SHA512 3f07b27f0750382c069113ff649466f66937c8e37ce481431aaccb3670b8dde37d9daf449cfea037a353f30dc3d0a22b4b517152dc9375ebfc43d932102f91b2
MD5 SHA1 SHA512

Submit Download

e41248d1-5b89-4423-8659-c245b5954959.vbs

Path C:\Users\Admin\AppData\Local\Temp\e41248d1-5b89-4423-8659-c245b5954959.vbs
Size 718B
SHA256 0c413571bd2f3d10a93b66a41f0ac83c12927ad300b499ad56f984d0309dbf45
MD5 2790d5e162b4634b9e9f18de9785c19e
SHA1 8a240ba55b13127b8a1a2e4e83a89023fbd793a9
SHA512 7b9a1b87b19808c0e985b3c2155db2f7c346562252e72fb831c59249feddc67e7c8f4564723a995ab55317e460bf3d792841fb26b569e2e9be8601cc436669f4
MD5 SHA1 SHA512

Submit Download

memory/1572-133-0x00007FFBD4DF0000-0x00007FFBD58B1000-memory.dmp

Download

memory/1572-134-0x000000001D7C0000-0x000000001D810000-memory.dmp

Download

memory/1572-135-0x000000001DED0000-0x000000001E3F8000-memory.dmp

Download

memory/1572-132-0x0000000000CB0000-0x0000000000F90000-memory.dmp

Download

memory/1572-139-0x00007FFBD4DF0000-0x00007FFBD58B1000-memory.dmp

Download

memory/4676-143-0x00007FFBD4DF0000-0x00007FFBD58B1000-memory.dmp

Download

memory/4676-148-0x00007FFBD4DF0000-0x00007FFBD58B1000-memory.dmp

Download