dcrat | 576437a881af98afed6680cd7fe0ae52adb87a528ece6d367eaf436765fe1d9e

General

Target

pTdbWeYTRtzW2gi.exe
Size

1.1MB
MD5

8496c268e5795f8734c886bf68ee141c
SHA1

dc642bd6fc6fad71ab5ac10cc35a040ad993db5c
SHA256

576437a881af98afed6680cd7fe0ae52adb87a528ece6d367eaf436765fe1d9e
SHA512

f7b7681352174ec9096fdf0dca8bbfaabac219cbea6f134fcd139cc77b52f861cc2034f8dda8c7d945c57ed6777fc193805ada1b95f8f2408cfd023c77a2d026
SSDEEP

12288:t6NE5eSwJu37+GXJpkaI7ShG54v4ahgVY3whNG8/LI6i4ejmtnbAouuFteLBdBN9:t6NReJXJIwvJgVQSoPEzKkLXa

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

pTdbWeYTRtzW2gi.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\d881ecfb1357f383d18f1e4fd0554eb0\\cbshandler\\lsass.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\winlogon.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\lsm.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Colors\\Idle.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\sppsvc.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\d881ecfb1357f383d18f1e4fd0554eb0\\cbshandler\\lsass.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\winlogon.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\lsm.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Colors\\Idle.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\sppsvc.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\pTdbWeYTRtzW2gi.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\d881ecfb1357f383d18f1e4fd0554eb0\\cbshandler\\lsass.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\winlogon.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\lsm.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Colors\\Idle.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\sppsvc.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\pTdbWeYTRtzW2gi.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\taskhost.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\d881ecfb1357f383d18f1e4fd0554eb0\\cbshandler\\lsass.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\d881ecfb1357f383d18f1e4fd0554eb0\\cbshandler\\lsass.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\winlogon.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\d881ecfb1357f383d18f1e4fd0554eb0\\cbshandler\\lsass.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\winlogon.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\lsm.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\d881ecfb1357f383d18f1e4fd0554eb0\\cbshandler\\lsass.exe\", \"C:\\Program Files\\Windows NT\\TableTextService\\winlogon.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\lsm.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Colors\\Idle.exe\""	pTdbWeYTRtzW2gi.exe

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	520	2000	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2000	schtasks.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1684-54-0x0000000000340000-0x000000000046C000-memory.dmp	dcrat
C:\MSOCache\All Users\csrss.exe	dcrat
C:\MSOCache\All Users\csrss.exe	dcrat
behavioral1/memory/1968-71-0x0000000000B00000-0x0000000000C2C000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

1968 csrss.exe

pid	process
1968	csrss.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pTdbWeYTRtzW2gi.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Colors\\Idle.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\sppsvc.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\pTdbWeYTRtzW2gi = "\"C:\\Program Files (x86)\\Internet Explorer\\pTdbWeYTRtzW2gi.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\taskhost.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\SoftwareDistribution\\Download\\d881ecfb1357f383d18f1e4fd0554eb0\\cbshandler\\lsass.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\SoftwareDistribution\\Download\\d881ecfb1357f383d18f1e4fd0554eb0\\cbshandler\\lsass.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Windows NT\\TableTextService\\winlogon.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Common Files\\Services\\lsm.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\sppsvc.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Windows NT\\TableTextService\\winlogon.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pTdbWeYTRtzW2gi = "\"C:\\Program Files (x86)\\Internet Explorer\\pTdbWeYTRtzW2gi.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\taskhost.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Common Files\\Services\\lsm.exe\""	pTdbWeYTRtzW2gi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Colors\\Idle.exe\""	pTdbWeYTRtzW2gi.exe

Drops file in Program Files directory 24 IoCs

Processes:

pTdbWeYTRtzW2gi.exe

description	ioc	process
File created	C:\Program Files\Windows NT\TableTextService\winlogon.exe	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\lsm.exe	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\RCX3A96.tmp	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\RCX53D4.tmp	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCX4300.tmp	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files\Windows NT\TableTextService\cc11b995f2a76d	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\6ccacd8608530f	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files (x86)\Internet Explorer\pTdbWeYTRtzW2gi.exe	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files (x86)\Internet Explorer\a5a6db4068229d	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\b75386f1303e64	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\winlogon.exe	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exe	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\pTdbWeYTRtzW2gi.exe	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files (x86)\Common Files\Services\lsm.exe	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files (x86)\Common Files\Services\101b941d020240	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhost.exe	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\RCX322D.tmp	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX4B6A.tmp	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhost.exe	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exe	pTdbWeYTRtzW2gi.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\0a1fd5f707cd16	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\RCX29C3.tmp	pTdbWeYTRtzW2gi.exe

Drops file in Windows directory 6 IoCs

Processes:

pTdbWeYTRtzW2gi.exe

description	ioc	process
File created	C:\Windows\Boot\PCAT\smss.exe	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\RCX2159.tmp	pTdbWeYTRtzW2gi.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\lsass.exe	pTdbWeYTRtzW2gi.exe
File created	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\lsass.exe	pTdbWeYTRtzW2gi.exe
File created	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\6203df4a6bafc7	pTdbWeYTRtzW2gi.exe
File created	C:\Windows\Speech\Common\de-DE\smss.exe	pTdbWeYTRtzW2gi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1672	schtasks.exe
1608	schtasks.exe
952	schtasks.exe
780	schtasks.exe
1632	schtasks.exe
1480	schtasks.exe
684	schtasks.exe
1076	schtasks.exe
520	schtasks.exe
1496	schtasks.exe
1360	schtasks.exe
580	schtasks.exe
1216	schtasks.exe
1304	schtasks.exe
776	schtasks.exe
1296	schtasks.exe
1628	schtasks.exe
672	schtasks.exe
1908	schtasks.exe
1676	schtasks.exe
576	schtasks.exe
1596	schtasks.exe
1924	schtasks.exe
1108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pTdbWeYTRtzW2gi.execsrss.exe

pid process

1684 pTdbWeYTRtzW2gi.exe
1968 csrss.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pTdbWeYTRtzW2gi.execsrss.exe

description pid process

Token: SeDebugPrivilege 1684 pTdbWeYTRtzW2gi.exe
Token: SeDebugPrivilege 1968 csrss.exe

pid	process
1684	pTdbWeYTRtzW2gi.exe
1968	csrss.exe

description	pid	process
Token: SeDebugPrivilege	1684	pTdbWeYTRtzW2gi.exe
Token: SeDebugPrivilege	1968	csrss.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

pTdbWeYTRtzW2gi.execmd.exe

description	pid	process	target process
PID 1684 wrote to memory of 1640	1684	pTdbWeYTRtzW2gi.exe	cmd.exe
PID 1684 wrote to memory of 1640	1684	pTdbWeYTRtzW2gi.exe	cmd.exe
PID 1684 wrote to memory of 1640	1684	pTdbWeYTRtzW2gi.exe	cmd.exe
PID 1640 wrote to memory of 576	1640	cmd.exe	w32tm.exe
PID 1640 wrote to memory of 576	1640	cmd.exe	w32tm.exe
PID 1640 wrote to memory of 576	1640	cmd.exe	w32tm.exe
PID 1640 wrote to memory of 1968	1640	cmd.exe	csrss.exe
PID 1640 wrote to memory of 1968	1640	cmd.exe	csrss.exe
PID 1640 wrote to memory of 1968	1640	cmd.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\pTdbWeYTRtzW2gi.exe
"C:\Users\Admin\AppData\Local\Temp\pTdbWeYTRtzW2gi.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NviAgREO5T.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:576

C:\MSOCache\All Users\csrss.exe
"C:\MSOCache\All Users\csrss.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\TableTextService\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Services\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Services\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "pTdbWeYTRtzW2gip" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\pTdbWeYTRtzW2gi.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "pTdbWeYTRtzW2gi" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\pTdbWeYTRtzW2gi.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "pTdbWeYTRtzW2gip" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\pTdbWeYTRtzW2gi.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Winlogon Helper DLL

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\csrss.exe

Filesize
1.1MB

MD5
dee78ec8daeaa95eb04eb0e529458601

SHA1
a18a7d8bc0dcbfe412789631ddc37ff08514779c

SHA256
780dc32c6248ad53494e90dae65d79aa9a5d41e3d7676363d80052d2ffefedbe

SHA512
f5a903d275fd6fe198dade0d37c0fde14c7b09dca59186ea7b0093fae8800caa35c464e001d1a68d160445b074bd9ee20913ad5e0469ffaf29ec6f9cb4e0a058

Download Submit
C:\MSOCache\All Users\csrss.exe

Filesize
1.1MB

MD5
dee78ec8daeaa95eb04eb0e529458601

SHA1
a18a7d8bc0dcbfe412789631ddc37ff08514779c

SHA256
780dc32c6248ad53494e90dae65d79aa9a5d41e3d7676363d80052d2ffefedbe

SHA512
f5a903d275fd6fe198dade0d37c0fde14c7b09dca59186ea7b0093fae8800caa35c464e001d1a68d160445b074bd9ee20913ad5e0469ffaf29ec6f9cb4e0a058

Download Submit
C:\Users\Admin\AppData\Local\Temp\NviAgREO5T.bat

Filesize
196B

MD5
2a32ab89103677c6e873fae2cb774839

SHA1
2754efe7d36f5e3165a60a746dc6c6b8adc6ca03

SHA256
19d46fe2cb3f2cf8da1d614b1621ef5d583e20348fa90de77faa14cf7d1cd3ae

SHA512
7013ede1a8f04b9add451fb9885a463f89b55e71424804c83ace95f573d8410d9b69c4f6ec413af4891aa9ea4fdfb59dead90d899f3cb7643d9697007334392a

Download Submit
memory/576-67-0x0000000000000000-mapping.dmp

Download
memory/1640-65-0x0000000000000000-mapping.dmp

Download
memory/1684-64-0x0000000000960000-0x000000000096C000-memory.dmp

Filesize
48KB

Download
memory/1684-58-0x00000000002F0000-0x0000000000302000-memory.dmp

Filesize
72KB

Download
memory/1684-61-0x0000000000670000-0x0000000000682000-memory.dmp

Filesize
72KB

Download
memory/1684-62-0x0000000000940000-0x0000000000948000-memory.dmp

Filesize
32KB

Download
memory/1684-63-0x0000000000950000-0x000000000095E000-memory.dmp

Filesize
56KB

Download
memory/1684-54-0x0000000000340000-0x000000000046C000-memory.dmp

Filesize
1.2MB

Download
memory/1684-59-0x0000000000910000-0x0000000000920000-memory.dmp

Filesize
64KB

Download
memory/1684-60-0x0000000000330000-0x000000000033C000-memory.dmp

Filesize
48KB

Download
memory/1684-57-0x0000000000310000-0x0000000000326000-memory.dmp

Filesize
88KB

Download
memory/1684-56-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/1684-55-0x00000000002C0000-0x00000000002DC000-memory.dmp

Filesize
112KB

Download
memory/1968-69-0x0000000000000000-mapping.dmp

Download
memory/1968-71-0x0000000000B00000-0x0000000000C2C000-memory.dmp

Filesize
1.2MB

Download
memory/1968-72-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/1968-73-0x0000000000970000-0x0000000000982000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads