dcrat | 01e29f940622ea5058fe8d7ce27d65dad6b03375e933aae9332cb0794f157182

General

Target

a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exe
Size

2.9MB
MD5

0bcc3265d6d56e45dab526559699b422
SHA1

7d39ccb90dd9bbfed5821fc0f99412c35a0042c0
SHA256

a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e
SHA512

9c9eaaf4bacb3db059b60807647c6aedfd3f00953ab29c35a13780df506774d4b04b678c6f6c7c3ae4ed5f8e07db0be48e76eff23b1c6a26454be55a47fa7bd9
SSDEEP

49152:UbA30uDZpwmT1XvIwCsVM69SorvgQM/Fngf2z5op/SyPfvxgN+B3Ah8:UbatphI3sVBdrvgj/Fgf2z5op/dPnxq+

Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	4108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	4108	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

System.exebridgeWebperf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgeWebperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bridgeWebperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bridgeWebperf.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\chainFont\bridgeWebperf.exe	dcrat
C:\chainFont\bridgeWebperf.exe	dcrat
behavioral2/memory/4616-139-0x00000000002F0000-0x0000000000588000-memory.dmp	dcrat
C:\Program Files (x86)\Reference Assemblies\System.exe	dcrat
C:\Program Files (x86)\Reference Assemblies\System.exe	dcrat

Executes dropped EXE 2 IoCs

Processes:

bridgeWebperf.exeSystem.exe

pid process

4616 bridgeWebperf.exe
924 System.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exeWScript.exebridgeWebperf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	bridgeWebperf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

bridgeWebperf.exeSystem.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bridgeWebperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgeWebperf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe

Drops file in Program Files directory 4 IoCs

Processes:

bridgeWebperf.exe

description	ioc	process
File created	C:\Program Files (x86)\Reference Assemblies\27d1bcfc3c54e0	bridgeWebperf.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\sppsvc.exe	bridgeWebperf.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\0a1fd5f707cd16	bridgeWebperf.exe
File created	C:\Program Files (x86)\Reference Assemblies\System.exe	bridgeWebperf.exe

Drops file in Windows directory 2 IoCs

Processes:

bridgeWebperf.exe

description	ioc	process
File created	C:\Windows\PLA\Rules\fr-FR\cc11b995f2a76d	bridgeWebperf.exe
File created	C:\Windows\PLA\Rules\fr-FR\winlogon.exe	bridgeWebperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4792	schtasks.exe
2572	schtasks.exe
1628	schtasks.exe
3112	schtasks.exe
3196	schtasks.exe
3956	schtasks.exe
2212	schtasks.exe
3616	schtasks.exe
4348	schtasks.exe
3500	schtasks.exe
1204	schtasks.exe
4408	schtasks.exe
3796	schtasks.exe
3428	schtasks.exe
4140	schtasks.exe
1116	schtasks.exe
3688	schtasks.exe
4944	schtasks.exe
1576	schtasks.exe
2244	schtasks.exe
4704	schtasks.exe
544	schtasks.exe
2824	schtasks.exe
4684	schtasks.exe
664	schtasks.exe
3236	schtasks.exe
4400	schtasks.exe

Modifies registry class 1 IoCs

Processes:

a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

bridgeWebperf.exeSystem.exe

pid	process
4616	bridgeWebperf.exe
4616	bridgeWebperf.exe
4616	bridgeWebperf.exe
4616	bridgeWebperf.exe
4616	bridgeWebperf.exe
4616	bridgeWebperf.exe
4616	bridgeWebperf.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe
924	System.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

System.exe

pid process

924 System.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bridgeWebperf.exeSystem.exe

description pid process

Token: SeDebugPrivilege 4616 bridgeWebperf.exe
Token: SeDebugPrivilege 924 System.exe

pid	process
924	System.exe

description	pid	process
Token: SeDebugPrivilege	4616	bridgeWebperf.exe
Token: SeDebugPrivilege	924	System.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exeWScript.execmd.exebridgeWebperf.exe

description	pid	process	target process
PID 4644 wrote to memory of 548	4644	a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exe	WScript.exe
PID 4644 wrote to memory of 548	4644	a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exe	WScript.exe
PID 4644 wrote to memory of 548	4644	a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exe	WScript.exe
PID 548 wrote to memory of 956	548	WScript.exe	cmd.exe
PID 548 wrote to memory of 956	548	WScript.exe	cmd.exe
PID 548 wrote to memory of 956	548	WScript.exe	cmd.exe
PID 956 wrote to memory of 4616	956	cmd.exe	bridgeWebperf.exe
PID 956 wrote to memory of 4616	956	cmd.exe	bridgeWebperf.exe
PID 4616 wrote to memory of 924	4616	bridgeWebperf.exe	System.exe
PID 4616 wrote to memory of 924	4616	bridgeWebperf.exe	System.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

bridgeWebperf.exeSystem.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bridgeWebperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgeWebperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bridgeWebperf.exe

C:\Users\Admin\AppData\Local\Temp\a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exe
"C:\Users\Admin\AppData\Local\Temp\a94aca257665bcea149485ab8facd158b5aa6d7c0885b68b56d1a97293dc663e.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\chainFont\f6LEq510ArPb.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\chainFont\im4gEs99.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\chainFont\bridgeWebperf.exe
"C:\chainFont\bridgeWebperf.exe"
4⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4616

C:\Program Files (x86)\Reference Assemblies\System.exe
"C:\Program Files (x86)\Reference Assemblies\System.exe"
5⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Recent\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Recent\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Recent\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\PLA\Rules\fr-FR\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\PLA\Rules\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\PLA\Rules\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Bypass User Account Control

Scheduled Task

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Reference Assemblies\System.exe

Filesize
2.6MB

MD5
369f77ade5f7b913959a3ff904bf6ca7

SHA1
6c4a8f69c5e4d1ba0546831d93017cd4a34af158

SHA256
534aeebad1da26ed057bbae6592a6ec24a7f8d5fff962d1a20639be1566ba850

SHA512
36b79caf2faaddf2b59221f0c86b390318e34f86908c6d7d5a6f88d22f41a8a1c2d28a148fad3b8ea774d0cec54a1842c7b90dd5adaff04e56b1ab88223932e8

Download Submit
C:\Program Files (x86)\Reference Assemblies\System.exe

Filesize
2.6MB

MD5
369f77ade5f7b913959a3ff904bf6ca7

SHA1
6c4a8f69c5e4d1ba0546831d93017cd4a34af158

SHA256
534aeebad1da26ed057bbae6592a6ec24a7f8d5fff962d1a20639be1566ba850

SHA512
36b79caf2faaddf2b59221f0c86b390318e34f86908c6d7d5a6f88d22f41a8a1c2d28a148fad3b8ea774d0cec54a1842c7b90dd5adaff04e56b1ab88223932e8

Download Submit
C:\chainFont\bridgeWebperf.exe

Filesize
2.6MB

MD5
369f77ade5f7b913959a3ff904bf6ca7

SHA1
6c4a8f69c5e4d1ba0546831d93017cd4a34af158

SHA256
534aeebad1da26ed057bbae6592a6ec24a7f8d5fff962d1a20639be1566ba850

SHA512
36b79caf2faaddf2b59221f0c86b390318e34f86908c6d7d5a6f88d22f41a8a1c2d28a148fad3b8ea774d0cec54a1842c7b90dd5adaff04e56b1ab88223932e8

Download Submit
C:\chainFont\bridgeWebperf.exe

Filesize
2.6MB

MD5
369f77ade5f7b913959a3ff904bf6ca7

SHA1
6c4a8f69c5e4d1ba0546831d93017cd4a34af158

SHA256
534aeebad1da26ed057bbae6592a6ec24a7f8d5fff962d1a20639be1566ba850

SHA512
36b79caf2faaddf2b59221f0c86b390318e34f86908c6d7d5a6f88d22f41a8a1c2d28a148fad3b8ea774d0cec54a1842c7b90dd5adaff04e56b1ab88223932e8

Download Submit
C:\chainFont\f6LEq510ArPb.vbe

Filesize
194B

MD5
9b1731fd52f1093ce5d2646806bb0f67

SHA1
1829c42c07b61f794cd6aa78d97c362ff435397d

SHA256
0eff669ac70c9c276b1e7347ccc209c53a0a44051a9db21670bf77e84f8b06be

SHA512
97c71cf1b9250292e723789c1720b10efe9be0154c4ec991b6d04914a57ce0140c1b19c26494ddefe2d2cf5830df6f99fefc43faf92c559ebe309fda93fe348e

Download Submit
C:\chainFont\im4gEs99.bat

Filesize
32B

MD5
0973a68ef3bb6e60eb01ed64d6dd4225

SHA1
420169a5dcb306495fe4373fbbfbf6faabcdb898

SHA256
49185aed14e2e8245ed5626349c3b32af69c6ddd4849e32364d81d80f2d63a90

SHA512
707f1fa491dd1a91b4274630762bad3aeb0c0ad520d4fd71548a10e1af2369cd6aa7872251fee40802dcf60ce551a4176a815d22c227623ca09c4ea75b1f19be

Download Submit
memory/548-132-0x0000000000000000-mapping.dmp

Download
memory/924-143-0x0000000000000000-mapping.dmp

Download
memory/924-148-0x00007FFBAD6A0000-0x00007FFBAE161000-memory.dmp

Filesize
10.8MB

Download
memory/924-147-0x00007FFBAD6A0000-0x00007FFBAE161000-memory.dmp

Filesize
10.8MB

Download
memory/956-135-0x0000000000000000-mapping.dmp

Download
memory/4616-136-0x0000000000000000-mapping.dmp

Download
memory/4616-142-0x000000001CB20000-0x000000001D048000-memory.dmp

Filesize
5.2MB

Download
memory/4616-141-0x000000001C480000-0x000000001C4D0000-memory.dmp

Filesize
320KB

Download
memory/4616-146-0x00007FFBAD6A0000-0x00007FFBAE161000-memory.dmp

Filesize
10.8MB

Download
memory/4616-140-0x00007FFBAD6A0000-0x00007FFBAE161000-memory.dmp

Filesize
10.8MB

Download
memory/4616-139-0x00000000002F0000-0x0000000000588000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads