dcrat | 1901ac563dc9ca30665837cb510c5e05b757e0017ac8e6dd038f1b8b87a69e30

General

Target

HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Size

1.3MB
MD5

bbcb2719208a4b82dce603101e18c7d9
SHA1

dc778b4cc86f331381cbbccf6c823a2c31225288
SHA256

1901ac563dc9ca30665837cb510c5e05b757e0017ac8e6dd038f1b8b87a69e30
SHA512

adec71d8daf3ae8bb241840808fb274bb997f8554b47057270c0cf06cc4696a6e1a55ebd977c7e67f8b66d08b36aed430498e6f209b7b543cf76d38c2c040a90
SSDEEP

24576:t/4NroVWFKq4XG+b3cuEx9V9P8nt6Qhc0yB+4:KNroVWhclcuE9VWoIJ

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\pla\\csrss.exe\", \"C:\\Windows\\twunk_16\\explorer.exe\", \"C:\\Windows\\System32\\DeviceDisplayStatusManager\\csrss.exe\", \"C:\\PerfLogs\\Admin\\Idle.exe\", \"C:\\Windows\\System32\\WMASF\\smss.exe\", \"C:\\Windows\\System32\\msxml3r\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\pla\\csrss.exe\", \"C:\\Windows\\twunk_16\\explorer.exe\", \"C:\\Windows\\System32\\DeviceDisplayStatusManager\\csrss.exe\", \"C:\\PerfLogs\\Admin\\Idle.exe\", \"C:\\Windows\\System32\\WMASF\\smss.exe\", \"C:\\Windows\\System32\\msxml3r\\csrss.exe\", \"C:\\Windows\\System32\\serwvdrv\\lsm.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\pla\\csrss.exe\", \"C:\\Windows\\twunk_16\\explorer.exe\", \"C:\\Windows\\System32\\DeviceDisplayStatusManager\\csrss.exe\", \"C:\\PerfLogs\\Admin\\Idle.exe\", \"C:\\Windows\\System32\\WMASF\\smss.exe\", \"C:\\Windows\\System32\\msxml3r\\csrss.exe\", \"C:\\Windows\\System32\\serwvdrv\\lsm.exe\", \"C:\\Windows\\System32\\msgsm32\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\pla\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\pla\\csrss.exe\", \"C:\\Windows\\twunk_16\\explorer.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\pla\\csrss.exe\", \"C:\\Windows\\twunk_16\\explorer.exe\", \"C:\\Windows\\System32\\DeviceDisplayStatusManager\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\pla\\csrss.exe\", \"C:\\Windows\\twunk_16\\explorer.exe\", \"C:\\Windows\\System32\\DeviceDisplayStatusManager\\csrss.exe\", \"C:\\PerfLogs\\Admin\\Idle.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\pla\\csrss.exe\", \"C:\\Windows\\twunk_16\\explorer.exe\", \"C:\\Windows\\System32\\DeviceDisplayStatusManager\\csrss.exe\", \"C:\\PerfLogs\\Admin\\Idle.exe\", \"C:\\Windows\\System32\\WMASF\\smss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1112-54-0x0000000001040000-0x0000000001192000-memory.dmp	dcrat
C:\Windows\System32\serwvdrv\lsm.exe	dcrat
C:\Windows\System32\serwvdrv\lsm.exe	dcrat
behavioral1/memory/1932-70-0x0000000000B10000-0x0000000000C62000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

lsm.exe

pid process

1932 lsm.exe

pid	process
1932	lsm.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\WMASF\\smss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\msgsm32\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\pla\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\twunk_16\\explorer.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\DeviceDisplayStatusManager\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\PerfLogs\\Admin\\Idle.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\WMASF\\smss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\msxml3r\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\PerfLogs\\Admin\\Idle.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\msxml3r\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\serwvdrv\\lsm.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\msgsm32\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\pla\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\twunk_16\\explorer.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\DeviceDisplayStatusManager\\csrss.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\serwvdrv\\lsm.exe\""	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe

Drops file in System32 directory 13 IoCs

Processes:

HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe

description	ioc	process
File created	C:\Windows\System32\DeviceDisplayStatusManager\886983d96e3d3e31032c679b2d4ea91b6c05afef	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\msxml3r\886983d96e3d3e31032c679b2d4ea91b6c05afef	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\pla\csrss.exe	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File opened for modification	C:\Windows\System32\pla\csrss.exe	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\pla\886983d96e3d3e31032c679b2d4ea91b6c05afef	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\DeviceDisplayStatusManager\csrss.exe	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\WMASF\smss.exe	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\WMASF\69ddcba757bf72f7d36c464c71f42baab150b2b9	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\msxml3r\csrss.exe	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\serwvdrv\lsm.exe	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\serwvdrv\101b941d020240259ca4912829b53995ad543df6	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\msgsm32\csrss.exe	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\System32\msgsm32\886983d96e3d3e31032c679b2d4ea91b6c05afef	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe

Drops file in Windows directory 2 IoCs

Processes:

HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe

description	ioc	process
File created	C:\Windows\twunk_16\explorer.exe	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
File created	C:\Windows\twunk_16\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1384 schtasks.exe
540 schtasks.exe
1568 schtasks.exe
988 schtasks.exe
1260 schtasks.exe
1740 schtasks.exe
560 schtasks.exe
1308 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1856 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exelsm.exe

pid process

1112 HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
1932 lsm.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exelsm.exe

description pid process

Token: SeDebugPrivilege 1112 HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Token: SeDebugPrivilege 1932 lsm.exe

pid	process
1384	schtasks.exe
540	schtasks.exe
1568	schtasks.exe
988	schtasks.exe
1260	schtasks.exe
1740	schtasks.exe
560	schtasks.exe
1308	schtasks.exe

pid	process
1856	PING.EXE

pid	process
1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
1932	lsm.exe

description	pid	process
Token: SeDebugPrivilege	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
Token: SeDebugPrivilege	1932	lsm.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.execmd.exe

description	pid	process	target process
PID 1112 wrote to memory of 1260	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1260	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1260	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1740	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1740	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1740	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 560	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 560	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 560	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1308	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1308	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1308	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1384	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1384	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1384	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 540	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 540	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 540	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1568	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1568	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1568	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 988	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 988	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 988	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	schtasks.exe
PID 1112 wrote to memory of 1832	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	cmd.exe
PID 1112 wrote to memory of 1832	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	cmd.exe
PID 1112 wrote to memory of 1832	1112	HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe	cmd.exe
PID 1832 wrote to memory of 912	1832	cmd.exe	chcp.com
PID 1832 wrote to memory of 912	1832	cmd.exe	chcp.com
PID 1832 wrote to memory of 912	1832	cmd.exe	chcp.com
PID 1832 wrote to memory of 1856	1832	cmd.exe	PING.EXE
PID 1832 wrote to memory of 1856	1832	cmd.exe	PING.EXE
PID 1832 wrote to memory of 1856	1832	cmd.exe	PING.EXE
PID 1832 wrote to memory of 1932	1832	cmd.exe	lsm.exe
PID 1832 wrote to memory of 1932	1832	cmd.exe	lsm.exe
PID 1832 wrote to memory of 1932	1832	cmd.exe	lsm.exe

C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.LightStone.gen-1901ac563dc.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\pla\csrss.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\twunk_16\explorer.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\DeviceDisplayStatusManager\csrss.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\PerfLogs\Admin\Idle.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\WMASF\smss.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1384

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\msxml3r\csrss.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\serwvdrv\lsm.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\msgsm32\csrss.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:988

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nFbtq0N3zk.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\system32\chcp.com
chcp 65001
3⤵
PID:912

C:\Windows\system32\PING.EXE
ping -n 5 localhost
3⤵
- Runs ping.exe
PID:1856

C:\Windows\System32\serwvdrv\lsm.exe
"C:\Windows\System32\serwvdrv\lsm.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Winlogon Helper DLL

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nFbtq0N3zk.bat

Filesize
202B

MD5
0a4597c1975617e9470e76c324304081

SHA1
73f913f74a951967f40b9eb5d09145678e95e777

SHA256
9a69f7afc7cd6dfe4d86d748c07b2a2c6e4132ca83154ee9ba96a43c082070d1

SHA512
86b96a5b160286f16f1f50bd2be142b9a57115045f09274b80a7b272e1042f2beac8507bfa87e318e89c909f0cc2f44ab424d8edb0e0e2d4d42f016e707c808c

Download Submit
C:\Windows\System32\serwvdrv\lsm.exe

Filesize
1.3MB

MD5
bbcb2719208a4b82dce603101e18c7d9

SHA1
dc778b4cc86f331381cbbccf6c823a2c31225288

SHA256
1901ac563dc9ca30665837cb510c5e05b757e0017ac8e6dd038f1b8b87a69e30

SHA512
adec71d8daf3ae8bb241840808fb274bb997f8554b47057270c0cf06cc4696a6e1a55ebd977c7e67f8b66d08b36aed430498e6f209b7b543cf76d38c2c040a90

Download Submit
C:\Windows\System32\serwvdrv\lsm.exe

Filesize
1.3MB

MD5
bbcb2719208a4b82dce603101e18c7d9

SHA1
dc778b4cc86f331381cbbccf6c823a2c31225288

SHA256
1901ac563dc9ca30665837cb510c5e05b757e0017ac8e6dd038f1b8b87a69e30

SHA512
adec71d8daf3ae8bb241840808fb274bb997f8554b47057270c0cf06cc4696a6e1a55ebd977c7e67f8b66d08b36aed430498e6f209b7b543cf76d38c2c040a90

Download Submit
memory/540-60-0x0000000000000000-mapping.dmp

Download
memory/560-57-0x0000000000000000-mapping.dmp

Download
memory/912-65-0x0000000000000000-mapping.dmp

Download
memory/988-62-0x0000000000000000-mapping.dmp

Download
memory/1112-54-0x0000000001040000-0x0000000001192000-memory.dmp

Filesize
1.3MB

Download
memory/1260-55-0x0000000000000000-mapping.dmp

Download
memory/1308-58-0x0000000000000000-mapping.dmp

Download
memory/1384-59-0x0000000000000000-mapping.dmp

Download
memory/1568-61-0x0000000000000000-mapping.dmp

Download
memory/1740-56-0x0000000000000000-mapping.dmp

Download
memory/1832-63-0x0000000000000000-mapping.dmp

Download
memory/1856-66-0x0000000000000000-mapping.dmp

Download
memory/1932-67-0x0000000000000000-mapping.dmp

Download
memory/1932-70-0x0000000000B10000-0x0000000000C62000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads