Overview

overview

10

Static

static

10

0a0a64f3c4...e8.exe

windows7-x64

10

0a0a64f3c4...e8.exe

windows10-2004-x64

10

Resubmissions

12/01/2023, 20:01

230112-yrh6hsae5210

07/01/2023, 04:41

230107-fa3jqagb8t10

07/01/2023, 04:21

230107-eynj2acf8710

Analysis

  • max time kernel
    61s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2023, 04:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
  • Size 3.8MB
  • Sample230107-eynj2acf87
  • SHA256 6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 55 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies WinLogon for persistence 2 TTPs 18 IoCs
    persistence
  • Process spawned unexpected child process 54 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Adds Run key to start application 2 TTPs 36 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops file in Program Files directory 45 IoCs
  • Drops file in Windows directory 7 IoCs
  • Creates scheduled task(s) 1 TTPs 54 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
    "C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2040
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'
      2⤵
        PID:2508
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'
        2⤵
          PID:2520
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\wininit.exe'
          2⤵
            PID:2540
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\it-IT\smss.exe'
            2⤵
              PID:2576
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'
              2⤵
                PID:2592
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\fr-FR\explorer.exe'
                2⤵
                  PID:2604
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'
                  2⤵
                    PID:2652
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'
                    2⤵
                      PID:2636
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\dwm.exe'
                      2⤵
                        PID:2712
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\de-DE\WMIADAP.exe'
                        2⤵
                          PID:2736
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'
                          2⤵
                            PID:2788
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1276
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1792
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1328
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\wininit.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:976
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:832
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1768
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\it-IT\smss.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1708
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\it-IT\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1156
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\it-IT\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:884
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1364
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1312
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1944
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\explorer.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1988
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:964
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1380
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2032
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2000
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1628
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1764
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:556
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:684
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\dwm.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1496
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\dwm.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1976
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\dwm.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:604
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\TableTextService\de-DE\WMIADAP.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1808
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\de-DE\WMIADAP.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1860
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\de-DE\WMIADAP.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1512
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "0a0a64f3c4fa7d960be983aa0a7d0ce80" /sc MINUTE /mo 9 /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1652
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "0a0a64f3c4fa7d960be983aa0a7d0ce8" /sc ONLOGON /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1068
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "0a0a64f3c4fa7d960be983aa0a7d0ce80" /sc MINUTE /mo 11 /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1624
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\WMIADAP.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1508
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\WMIADAP.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1092
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\WMIADAP.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:952
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:580
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1096
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:276
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Journal\Templates\smss.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2064
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\Templates\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2084
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Journal\Templates\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2112
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\csrss.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2136
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2164
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2180
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dwm.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2208
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dwm.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2228
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dwm.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2256
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "0a0a64f3c4fa7d960be983aa0a7d0ce80" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2284
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "0a0a64f3c4fa7d960be983aa0a7d0ce8" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2300
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "0a0a64f3c4fa7d960be983aa0a7d0ce80" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2332
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2352
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2372
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2400
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\csrss.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2424
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2440
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2468

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              590aee7bdd69b59b.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                              • Size 7KB
                              • SHA256 86bf01a3f99b00ec5488d4053c1914a913bb29e5e7ae17ff10bb29e711fe20f2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              590aee7bdd69b59b.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                              • Size 7KB
                              • SHA256 86bf01a3f99b00ec5488d4053c1914a913bb29e5e7ae17ff10bb29e711fe20f2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              590aee7bdd69b59b.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                              • Size 7KB
                              • SHA256 86bf01a3f99b00ec5488d4053c1914a913bb29e5e7ae17ff10bb29e711fe20f2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              590aee7bdd69b59b.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                              • Size 7KB
                              • SHA256 86bf01a3f99b00ec5488d4053c1914a913bb29e5e7ae17ff10bb29e711fe20f2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              590aee7bdd69b59b.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                              • Size 7KB
                              • SHA256 86bf01a3f99b00ec5488d4053c1914a913bb29e5e7ae17ff10bb29e711fe20f2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              590aee7bdd69b59b.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                              • Size 7KB
                              • SHA256 86bf01a3f99b00ec5488d4053c1914a913bb29e5e7ae17ff10bb29e711fe20f2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              590aee7bdd69b59b.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                              • Size 7KB
                              • SHA256 86bf01a3f99b00ec5488d4053c1914a913bb29e5e7ae17ff10bb29e711fe20f2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              590aee7bdd69b59b.customDestinations-ms
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                              • Size 7KB
                              • SHA256 86bf01a3f99b00ec5488d4053c1914a913bb29e5e7ae17ff10bb29e711fe20f2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              memory/2040-68-0x000000001ABB0000-0x000000001ABBA000-memory.dmp
                              Download

                              memory/2040-73-0x000000001B020000-0x000000001B02C000-memory.dmp
                              Download

                              memory/2040-64-0x0000000000D50000-0x0000000000D5C000-memory.dmp
                              Download

                              memory/2040-65-0x0000000000D60000-0x0000000000D68000-memory.dmp
                              Download

                              memory/2040-66-0x000000001AFB0000-0x000000001B006000-memory.dmp
                              Download

                              memory/2040-67-0x000000001ABA0000-0x000000001ABA8000-memory.dmp
                              Download

                              memory/2040-62-0x0000000000D10000-0x0000000000D22000-memory.dmp
                              Download

                              memory/2040-69-0x000000001ABC0000-0x000000001ABCE000-memory.dmp
                              Download

                              memory/2040-70-0x000000001ABD0000-0x000000001ABD8000-memory.dmp
                              Download

                              memory/2040-71-0x000000001B000000-0x000000001B00E000-memory.dmp
                              Download

                              memory/2040-72-0x000000001B010000-0x000000001B018000-memory.dmp
                              Download

                              memory/2040-63-0x0000000000D40000-0x0000000000D48000-memory.dmp
                              Download

                              memory/2040-74-0x000000001B040000-0x000000001B04A000-memory.dmp
                              Download

                              memory/2040-75-0x000000001B050000-0x000000001B05C000-memory.dmp
                              Download

                              memory/2040-61-0x0000000000B70000-0x0000000000B7C000-memory.dmp
                              Download

                              memory/2040-60-0x0000000000500000-0x0000000000556000-memory.dmp
                              Download

                              memory/2040-59-0x0000000000300000-0x000000000030A000-memory.dmp
                              Download

                              memory/2040-58-0x00000000004E0000-0x00000000004F6000-memory.dmp
                              Download

                              memory/2040-57-0x00000000002F0000-0x0000000000300000-memory.dmp
                              Download

                              memory/2040-56-0x00000000002E0000-0x00000000002E8000-memory.dmp
                              Download

                              memory/2040-55-0x00000000002C0000-0x00000000002DC000-memory.dmp
                              Download

                              memory/2040-54-0x0000000000F50000-0x000000000131A000-memory.dmp
                              Download

                              memory/2520-89-0x000007FEEA720000-0x000007FEEB143000-memory.dmp
                              Download

                              memory/2520-82-0x000007FEFB5F1000-0x000007FEFB5F3000-memory.dmp
                              Download

                              memory/2520-131-0x0000000002294000-0x0000000002297000-memory.dmp
                              Download

                              memory/2540-125-0x0000000002384000-0x0000000002387000-memory.dmp
                              Download

                              memory/2540-107-0x000007FEEA720000-0x000007FEEB143000-memory.dmp
                              Download

                              memory/2576-113-0x000007FEEA720000-0x000007FEEB143000-memory.dmp
                              Download

                              memory/2576-128-0x0000000002784000-0x0000000002787000-memory.dmp
                              Download

                              memory/2592-126-0x0000000002374000-0x0000000002377000-memory.dmp
                              Download

                              memory/2592-112-0x000007FEEA720000-0x000007FEEB143000-memory.dmp
                              Download

                              memory/2604-111-0x000007FEEA720000-0x000007FEEB143000-memory.dmp
                              Download

                              memory/2604-129-0x0000000002854000-0x0000000002857000-memory.dmp
                              Download

                              memory/2636-108-0x000007FEEA720000-0x000007FEEB143000-memory.dmp
                              Download

                              memory/2636-127-0x0000000002484000-0x0000000002487000-memory.dmp
                              Download

                              memory/2652-124-0x0000000002554000-0x0000000002557000-memory.dmp
                              Download

                              memory/2652-106-0x000007FEEA720000-0x000007FEEB143000-memory.dmp
                              Download

                              memory/2712-117-0x0000000001FF4000-0x0000000001FF7000-memory.dmp
                              Download

                              memory/2712-109-0x000007FEEA720000-0x000007FEEB143000-memory.dmp
                              Download

                              memory/2736-110-0x000007FEEA720000-0x000007FEEB143000-memory.dmp
                              Download

                              memory/2736-130-0x00000000025D4000-0x00000000025D7000-memory.dmp
                              Download