Resubmissions
12-01-2023 20:01
230112-yrh6hsae52 1007-01-2023 04:41
230107-fa3jqagb8t 1007-01-2023 04:21
230107-eynj2acf87 10Analysis
-
max time kernel
60s -
max time network
62s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
07-01-2023 04:41
General
-
Target
0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
-
Size
3.8MB
-
MD5
0a0a64f3c4fa7d960be983aa0a7d0ce8
-
SHA1
b597c7397ecaff7c5c1aa27f5124fc7b8a94e643
-
SHA256
6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
-
SHA512
ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4
-
SSDEEP
98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1
Malware Config
Signatures
-
DcRat 55 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 18 IoCs
-
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 9 IoCs
-
DCRat payload 4 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Executes dropped EXE 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 36 IoCs
-
Checks whether UAC is enabled 1 TTPs 6 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 33 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 48 IoCs
-
System policy modification 1 TTPs 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dwm.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sppsvc.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dllhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\fontdrvhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\OfficeClickToRun.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\smss.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SearchUI.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\System.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchUI.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender Advanced Threat Protection\fontdrvhost.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\dwm.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\ShellExperienceHost.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\conhost.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\it-IT\Idle.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\csrss.exe'3⤵
-
C:\Program Files\Windows Defender Advanced Threat Protection\fontdrvhost.exe"C:\Program Files\Windows Defender Advanced Threat Protection\fontdrvhost.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31dd1b96-9409-4c68-bb10-d7fb4b05d1e5.vbs"4⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eec7a383-de10-42ab-92bb-6a32ae078251.vbs"4⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\odt\sppsvc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\OfficeClickToRun.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\odt\smss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 11 /tr "'C:\odt\SearchUI.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\odt\SearchUI.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 14 /tr "'C:\odt\SearchUI.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\System.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\conhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\ShellExperienceHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Java\ShellExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\ShellExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\AppPatch\it-IT\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\AppPatch\it-IT\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Windows\AppPatch\it-IT\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\odt\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Defender Advanced Threat Protection\fontdrvhost.exeFilesize
3.8MB
MD50a0a64f3c4fa7d960be983aa0a7d0ce8
SHA1b597c7397ecaff7c5c1aa27f5124fc7b8a94e643
SHA2566d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
SHA512ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4
-
C:\Program Files\Windows Defender Advanced Threat Protection\fontdrvhost.exeFilesize
3.8MB
MD50a0a64f3c4fa7d960be983aa0a7d0ce8
SHA1b597c7397ecaff7c5c1aa27f5124fc7b8a94e643
SHA2566d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
SHA512ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe.logFilesize
1KB
MD5430a3e587f99c7640a58a042ce63bdd6
SHA15d11d6b74e56cf622796971b8f57f57ca37592db
SHA256a087c10187c77ec487d0dcce45d36d5b1ff44f063aba489a17937f041de70bf7
SHA5120b2422fceade7f32cabf29cbb658663ec6f05c977435f66d1bd80c99ae0043e0d95f1bfafa4ec4fe84bc77a1a3b45bf38e84ce8737a6cf2b25bad4e37af0797d
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5d6b44ed70c3279aaecbcdde770789ad4
SHA14b13ee25c1dc3cba06cce215da101d2a1dd5dec1
SHA256bfd1b8e59e279daa17edaa2e2726a021cc522ca16fd8c36ed7422f67930d9a36
SHA5126b1756b393326c46bcfd701fbc851cc890cffca5f03ba614ae08dc584c73545e8ebf1387b6a2ca2a0c17668c592481b7a33cb7f1fea4a22abcd54901a12e72da
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD557534bafcd473ca1eeb9ec3461d12f89
SHA1f50525e3c1cbda1467d5b517b8c41c18853ffdfd
SHA256693cbaa4b8ccff3b2051aec2be3fea701118742eb7147d1b8cebdc444e517279
SHA51270a942cbe77b5896ba2c7eade4e5cb635de1cde7eff5130911da96626899b2503fa5f3d5da75b773eb8c8c4c17a8afb62de0969918e71a865ec53434d4ced06f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5c1ac3fd7cbef03dd38a889057ff260b1
SHA113ae22f1d34a767c8165937936950bea7aff37e2
SHA25659be7c36f9920eca0a8f7760dbbef791cea61f98c2234b01e6e656a040bbe1c6
SHA512eb0717cbb68d522349b482ba167512ca67d72a2c2fbe2147c42690468b9e21ff609e01c644b445b0de0ecbff8465acc691159d4e9080cc53f2511b0a6a2b9052
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5c1ac3fd7cbef03dd38a889057ff260b1
SHA113ae22f1d34a767c8165937936950bea7aff37e2
SHA25659be7c36f9920eca0a8f7760dbbef791cea61f98c2234b01e6e656a040bbe1c6
SHA512eb0717cbb68d522349b482ba167512ca67d72a2c2fbe2147c42690468b9e21ff609e01c644b445b0de0ecbff8465acc691159d4e9080cc53f2511b0a6a2b9052
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5466cd9f996d94424aba7006192abe6da
SHA12202fd536886c88e4a2613371dafa47feaed9cee
SHA2564ebbbce82c5c1cee2fe63d9c1e117e237a4751844817d41deab7ca94a6b73355
SHA512e64c46c724fffc6ef2508550aade4be0b082b00f3e45a6d0f915715ef1fd5c3a7ca95ef4547e50e6a529ed6904e4073dd11f9f0a03d35aa05af799e79b86ec5a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5eceeb71377508d51182ee7195e0d5833
SHA159c127b1f0b090e236c268ff57fd1911c956a5d5
SHA256990065c45ac45750afb8ee7f930c7745bb152f02153cce58c01aa911e5cf2c16
SHA512bf2ff034bf6b3bc152972d1aff681182ac4ca7ab3d1deeb6fc2d0dd3a034494d206c68c4a21f4fcec3517c64840dc956c746b440b9f72f62da9784b5cd582b99
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5eceeb71377508d51182ee7195e0d5833
SHA159c127b1f0b090e236c268ff57fd1911c956a5d5
SHA256990065c45ac45750afb8ee7f930c7745bb152f02153cce58c01aa911e5cf2c16
SHA512bf2ff034bf6b3bc152972d1aff681182ac4ca7ab3d1deeb6fc2d0dd3a034494d206c68c4a21f4fcec3517c64840dc956c746b440b9f72f62da9784b5cd582b99
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5eceeb71377508d51182ee7195e0d5833
SHA159c127b1f0b090e236c268ff57fd1911c956a5d5
SHA256990065c45ac45750afb8ee7f930c7745bb152f02153cce58c01aa911e5cf2c16
SHA512bf2ff034bf6b3bc152972d1aff681182ac4ca7ab3d1deeb6fc2d0dd3a034494d206c68c4a21f4fcec3517c64840dc956c746b440b9f72f62da9784b5cd582b99
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5eceeb71377508d51182ee7195e0d5833
SHA159c127b1f0b090e236c268ff57fd1911c956a5d5
SHA256990065c45ac45750afb8ee7f930c7745bb152f02153cce58c01aa911e5cf2c16
SHA512bf2ff034bf6b3bc152972d1aff681182ac4ca7ab3d1deeb6fc2d0dd3a034494d206c68c4a21f4fcec3517c64840dc956c746b440b9f72f62da9784b5cd582b99
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5eceeb71377508d51182ee7195e0d5833
SHA159c127b1f0b090e236c268ff57fd1911c956a5d5
SHA256990065c45ac45750afb8ee7f930c7745bb152f02153cce58c01aa911e5cf2c16
SHA512bf2ff034bf6b3bc152972d1aff681182ac4ca7ab3d1deeb6fc2d0dd3a034494d206c68c4a21f4fcec3517c64840dc956c746b440b9f72f62da9784b5cd582b99
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD58db7f4effc1201d09ae4d7d1dd05f209
SHA10fe184d3fb4766ac86ec6f59f6ae61db9443d51b
SHA2563f2652bbd6e88ff06dccb01eb79ab94d0346e452046bcc55c29de2f15cacfa14
SHA512b01154ccb91373832fa873f8faeecba49095d424d819667f6605ddae18bd48f5f69c184cf86c59d084f89cc50fadb170a5a114fd5eb1bc5a38a2dd086bb158fb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD58db7f4effc1201d09ae4d7d1dd05f209
SHA10fe184d3fb4766ac86ec6f59f6ae61db9443d51b
SHA2563f2652bbd6e88ff06dccb01eb79ab94d0346e452046bcc55c29de2f15cacfa14
SHA512b01154ccb91373832fa873f8faeecba49095d424d819667f6605ddae18bd48f5f69c184cf86c59d084f89cc50fadb170a5a114fd5eb1bc5a38a2dd086bb158fb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD58e6159e3de8cae3068949fd94fbefab5
SHA160200a5846892a4482338ab541095dd1a8839270
SHA256da84314273ba385aaa7d45ed23117b67d923af02ee947dbea0c7f82b4e5c7d09
SHA5126c299217f7bc22b85c02e874d9b94a25e47b7944cdac9bdafa287f93599f616fbb5878c2e2fb9e2609c679076f31f7ae808b0bca2d06b99c2026eaa6eb619c49
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD53be93bdbc958798cc58c679efb404b72
SHA1ed24fe09423667d5274b4dddd29779a83c7d7bcb
SHA2563f6464b62c8e35ec7ae1a3d8968546ecb8f49e2ba5be92490de4fe8ab4c579f4
SHA512b976faf5db78ee119ef67083671f0105e0f5611573a8a243e1023dd38f11fe04e33bba694ff1898fc4ed615d8cace0bf446f9d5c46cb4d9ab642faa089f94212
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e5a8896a6ed8ef05f42b7ff55831ce6c
SHA10d33b5622ff40ec73eea2395f05f5b66f82e2fc1
SHA25674dc54eb6b46755cdbedf86987f894e88e8302e47d6640f73d91f484878be0bb
SHA5128fc0ed5fe9aaf779cb2888541d5cdff7864f9b7bdc2017ab13749f2c917064007c284636d12e941228040b2816292045e140ba977c3eab7506a3235288ad47dd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e5a8896a6ed8ef05f42b7ff55831ce6c
SHA10d33b5622ff40ec73eea2395f05f5b66f82e2fc1
SHA25674dc54eb6b46755cdbedf86987f894e88e8302e47d6640f73d91f484878be0bb
SHA5128fc0ed5fe9aaf779cb2888541d5cdff7864f9b7bdc2017ab13749f2c917064007c284636d12e941228040b2816292045e140ba977c3eab7506a3235288ad47dd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD515913e7211a672306284bd202e4fe858
SHA16789f1ba89336dba4d865b1b63b8909b6fa71912
SHA256deda642fb0eea26bd13493bfd0ca9b773e0c341a693b92246539f3e7104b2d7e
SHA51241778e50015891de5a5af8ca32b95eaab5dc920bb4277b250ae3afb3752d2520c27f1c4c3e3d5c2c9b99cf726dc8da1183e465fada29e5fbee01481179099e5b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD515913e7211a672306284bd202e4fe858
SHA16789f1ba89336dba4d865b1b63b8909b6fa71912
SHA256deda642fb0eea26bd13493bfd0ca9b773e0c341a693b92246539f3e7104b2d7e
SHA51241778e50015891de5a5af8ca32b95eaab5dc920bb4277b250ae3afb3752d2520c27f1c4c3e3d5c2c9b99cf726dc8da1183e465fada29e5fbee01481179099e5b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5a2adb9e398818722842db0a07cf678b5
SHA1293286040f46cfcec161aac4f0c63cd3b824d5d8
SHA2563a11322cd866b4f6e399b59fdb964dfa07b3dc6ea9b3be9c6d82651b99cac8a6
SHA512f44c3897d4042b9ec75dddd7d5657da30a54dd3725982a0443a3f223d4fad38fb8a7d5b0ac595e8f1cb63a0fb3728a2056773dba786d1c4d0743fa9bdb8be54f
-
C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exeFilesize
3.8MB
MD50a0a64f3c4fa7d960be983aa0a7d0ce8
SHA1b597c7397ecaff7c5c1aa27f5124fc7b8a94e643
SHA2566d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
SHA512ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4
-
C:\Users\Admin\AppData\Local\Temp\31dd1b96-9409-4c68-bb10-d7fb4b05d1e5.vbsFilesize
752B
MD5bd8ce8d34a1e4e8cc229ac3de365bb15
SHA11e7d6702a476e54a3bd1fb297ea7ebf3b2104048
SHA2568adcf4a792e11181c198220239ce86fb56e5d1c6455da492bb2eba1acca61de8
SHA51215be4bc221a998d87db089773a4e606e71c59cf76aa4b0bc82bcf1b460f6b762f9dd73e20a8ca44d4a951db3c1b369932c6d5b12d557c00639f411a512d9a634
-
C:\Users\Admin\AppData\Local\Temp\e049f5be7f56852d18b36b1316bf13f0812d82444.5.3225.12-26.1270cc8d3ef51614fede5606e4e0ff645b10b785a5Filesize
584B
MD577bbebc0660bda7464af87e63833097f
SHA11be55589a6a62df9fd253bb7c39be2f7b185e09a
SHA2568889c7ec5e2ed6bac26ea2d6bf9669e34680ad993d7e119d80c23f8a67004065
SHA51233acec233053dca89534feaca721f3e5b072c000a4aa0273f99c4e8c47781f719e4314c0d3a75528d25856f80a8107d0e88a23ed4e11b13198d38d0e073f4093
-
C:\Users\Admin\AppData\Local\Temp\eec7a383-de10-42ab-92bb-6a32ae078251.vbsFilesize
528B
MD5c77e2a9e22c05f1130dcd8565372c3d0
SHA169f7378b8e613e3e0663b2df86e0d78fac694bd9
SHA25622ea901c3453083c8a9ca96f1763b77410cacf26cfa9aa0d7c2d2d97463910bf
SHA512de1d56dd7fb3e634c96ff1a7eb066f3b80105ecefca3b0189e6d014058c168b4c0851ebeb260d9611d52d078d776445e401046e272a63902b05edd347778bafe
-
memory/708-143-0x0000000000000000-mapping.dmp
-
memory/1660-585-0x0000000000000000-mapping.dmp
-
memory/1884-588-0x0000000000000000-mapping.dmp
-
memory/1896-152-0x0000000000000000-mapping.dmp
-
memory/2088-868-0x0000000000000000-mapping.dmp
-
memory/2248-141-0x0000000000000000-mapping.dmp
-
memory/2556-140-0x0000000000000000-mapping.dmp
-
memory/2556-200-0x00000293EF2F0000-0x00000293EF312000-memory.dmpFilesize
136KB
-
memory/2772-136-0x000000001C030000-0x000000001C038000-memory.dmpFilesize
32KB
-
memory/2772-137-0x000000001C040000-0x000000001C04C000-memory.dmpFilesize
48KB
-
memory/2772-129-0x0000000002D10000-0x0000000002D18000-memory.dmpFilesize
32KB
-
memory/2772-117-0x0000000002D50000-0x0000000002D6C000-memory.dmpFilesize
112KB
-
memory/2772-118-0x000000001B8F0000-0x000000001B940000-memory.dmpFilesize
320KB
-
memory/2772-130-0x000000001BFC0000-0x000000001C016000-memory.dmpFilesize
344KB
-
memory/2772-131-0x0000000002D20000-0x0000000002D28000-memory.dmpFilesize
32KB
-
memory/2772-119-0x0000000001550000-0x0000000001558000-memory.dmpFilesize
32KB
-
memory/2772-120-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/2772-121-0x0000000002D90000-0x0000000002DA6000-memory.dmpFilesize
88KB
-
memory/2772-122-0x0000000002DB0000-0x0000000002DBA000-memory.dmpFilesize
40KB
-
memory/2772-127-0x000000001B970000-0x000000001B978000-memory.dmpFilesize
32KB
-
memory/2772-123-0x000000001B8A0000-0x000000001B8F6000-memory.dmpFilesize
344KB
-
memory/2772-139-0x000000001C070000-0x000000001C07C000-memory.dmpFilesize
48KB
-
memory/2772-138-0x000000001C060000-0x000000001C06A000-memory.dmpFilesize
40KB
-
memory/2772-128-0x000000001BFB0000-0x000000001BFBC000-memory.dmpFilesize
48KB
-
memory/2772-116-0x0000000000930000-0x0000000000CFA000-memory.dmpFilesize
3.8MB
-
memory/2772-135-0x000000001C020000-0x000000001C02E000-memory.dmpFilesize
56KB
-
memory/2772-134-0x000000001C010000-0x000000001C018000-memory.dmpFilesize
32KB
-
memory/2772-133-0x0000000002D40000-0x0000000002D4E000-memory.dmpFilesize
56KB
-
memory/2772-124-0x000000001B940000-0x000000001B94C000-memory.dmpFilesize
48KB
-
memory/2772-132-0x0000000002D30000-0x0000000002D3A000-memory.dmpFilesize
40KB
-
memory/2772-125-0x000000001B950000-0x000000001B962000-memory.dmpFilesize
72KB
-
memory/2772-126-0x000000001C4E0000-0x000000001CA06000-memory.dmpFilesize
5.1MB
-
memory/3176-144-0x0000000000000000-mapping.dmp
-
memory/3240-589-0x0000000000000000-mapping.dmp
-
memory/3556-583-0x0000000000000000-mapping.dmp
-
memory/3832-261-0x0000000001960000-0x0000000001972000-memory.dmpFilesize
72KB
-
memory/3832-254-0x00000000017F0000-0x0000000001846000-memory.dmpFilesize
344KB
-
memory/3832-201-0x0000000000000000-mapping.dmp
-
memory/3916-142-0x0000000000000000-mapping.dmp
-
memory/4076-587-0x0000000000000000-mapping.dmp
-
memory/4088-586-0x0000000000000000-mapping.dmp
-
memory/4292-145-0x0000000000000000-mapping.dmp
-
memory/4428-584-0x0000000000000000-mapping.dmp
-
memory/4552-155-0x0000000000000000-mapping.dmp
-
memory/4552-218-0x000001E97F780000-0x000001E97F7F6000-memory.dmpFilesize
472KB
-
memory/4624-146-0x0000000000000000-mapping.dmp
-
memory/4636-147-0x0000000000000000-mapping.dmp
-
memory/4796-867-0x0000000000000000-mapping.dmp
-
memory/4872-619-0x0000000000000000-mapping.dmp
-
memory/4872-637-0x000000001B8F0000-0x000000001B902000-memory.dmpFilesize
72KB
-
memory/4872-871-0x000000001EDD0000-0x000000001EF92000-memory.dmpFilesize
1.8MB
-
memory/4888-582-0x0000000000000000-mapping.dmp
-
memory/4916-150-0x0000000000000000-mapping.dmp
-
memory/5036-148-0x0000000000000000-mapping.dmp