dcrat | 5f44a568a45580bb598b8a5a81ca26e74e3cea5b78689ed715ab0c8848673541

Processes:

hyperAgentCommon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\comFont\\sihost.exe\""	hyperAgentCommon.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	3448	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	3448	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	3448	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	3448	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	3448	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	3448	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	3448	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3448	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	3448	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Processes:

hyperAgentCommon.exesihost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\comFont\hyperAgentCommon.exe	dcrat
C:\comFont\hyperAgentCommon.exe	dcrat
behavioral2/memory/2188-141-0x0000000000D40000-0x0000000000FF0000-memory.dmp	dcrat
C:\comFont\sihost.exe	dcrat
C:\comFont\sihost.exe	dcrat

Disables Task Manager via registry modification
evasion
Executes dropped EXE 2 IoCs

Processes:

hyperAgentCommon.exesihost.exe

pid process

2188 hyperAgentCommon.exe
2544 sihost.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

inject_fortniteV3.0.exeWScript.exehyperAgentCommon.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	inject_fortniteV3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	hyperAgentCommon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

hyperAgentCommon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\comFont\\sihost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\comFont\\sihost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\""	hyperAgentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\""	hyperAgentCommon.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

sihost.exehyperAgentCommon.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperAgentCommon.exe

Drops file in Program Files directory 3 IoCs

Processes:

hyperAgentCommon.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Portable Devices\dllhost.exe	hyperAgentCommon.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\dllhost.exe	hyperAgentCommon.exe
File created	C:\Program Files (x86)\Windows Portable Devices\5940a34987c991	hyperAgentCommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1392	schtasks.exe
4700	schtasks.exe
2136	schtasks.exe
4216	schtasks.exe
2532	schtasks.exe
4480	schtasks.exe
2720	schtasks.exe
1772	schtasks.exe
1128	schtasks.exe

Modifies registry class 2 IoCs

Processes:

hyperAgentCommon.exeinject_fortniteV3.0.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	hyperAgentCommon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	inject_fortniteV3.0.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

756 reg.exe

pid	process
756	reg.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

hyperAgentCommon.exesihost.exe

pid	process
2188	hyperAgentCommon.exe
2188	hyperAgentCommon.exe
2188	hyperAgentCommon.exe
2188	hyperAgentCommon.exe
2188	hyperAgentCommon.exe
2188	hyperAgentCommon.exe
2188	hyperAgentCommon.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe
2544	sihost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

sihost.exe

pid process

2544 sihost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

hyperAgentCommon.exesihost.exe

description pid process

Token: SeDebugPrivilege 2188 hyperAgentCommon.exe
Token: SeDebugPrivilege 2544 sihost.exe

pid	process
2544	sihost.exe

description	pid	process
Token: SeDebugPrivilege	2188	hyperAgentCommon.exe
Token: SeDebugPrivilege	2544	sihost.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

inject_fortniteV3.0.exeWScript.execmd.exehyperAgentCommon.execmd.exe

description	pid	process	target process
PID 768 wrote to memory of 444	768	inject_fortniteV3.0.exe	WScript.exe
PID 768 wrote to memory of 444	768	inject_fortniteV3.0.exe	WScript.exe
PID 768 wrote to memory of 444	768	inject_fortniteV3.0.exe	WScript.exe
PID 768 wrote to memory of 2256	768	inject_fortniteV3.0.exe	WScript.exe
PID 768 wrote to memory of 2256	768	inject_fortniteV3.0.exe	WScript.exe
PID 768 wrote to memory of 2256	768	inject_fortniteV3.0.exe	WScript.exe
PID 444 wrote to memory of 2056	444	WScript.exe	cmd.exe
PID 444 wrote to memory of 2056	444	WScript.exe	cmd.exe
PID 444 wrote to memory of 2056	444	WScript.exe	cmd.exe
PID 2056 wrote to memory of 2188	2056	cmd.exe	hyperAgentCommon.exe
PID 2056 wrote to memory of 2188	2056	cmd.exe	hyperAgentCommon.exe
PID 2188 wrote to memory of 4472	2188	hyperAgentCommon.exe	cmd.exe
PID 2188 wrote to memory of 4472	2188	hyperAgentCommon.exe	cmd.exe
PID 4472 wrote to memory of 608	4472	cmd.exe	w32tm.exe
PID 4472 wrote to memory of 608	4472	cmd.exe	w32tm.exe
PID 2056 wrote to memory of 756	2056	cmd.exe	reg.exe
PID 2056 wrote to memory of 756	2056	cmd.exe	reg.exe
PID 2056 wrote to memory of 756	2056	cmd.exe	reg.exe
PID 4472 wrote to memory of 2544	4472	cmd.exe	sihost.exe
PID 4472 wrote to memory of 2544	4472	cmd.exe	sihost.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

Processes:

hyperAgentCommon.exesihost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperAgentCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperAgentCommon.exe

C:\Users\Admin\AppData\Local\Temp\inject_fortniteV3.0.exe
"C:\Users\Admin\AppData\Local\Temp\inject_fortniteV3.0.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\comFont\MTGYlSdhuDKs8XfONjnFlP.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:444

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\comFont\E1o0vS.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\comFont\hyperAgentCommon.exe
"C:\comFont\hyperAgentCommon.exe"
4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zTR87A5U1o.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:4472

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:608

C:\comFont\sihost.exe
"C:\comFont\sihost.exe"
6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2544

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:756

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\comFont\file.vbs"
2⤵
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\comFont\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\comFont\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\comFont\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Modify Registry

5

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry