dcrat | 24277b308f5f5d2154a648564965df5153921a2b66e3766223732f7f9cfeaca8

Analysis

max time kernel
142s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WEXTRACT.exe
Size

7.2MB
MD5

1031f7f6ee923fa952dbe18807039570
SHA1

01a144e221c3a67b4bdc2ad3662a682b66d4dd4a
SHA256

24277b308f5f5d2154a648564965df5153921a2b66e3766223732f7f9cfeaca8
SHA512

86abaa547484b599039502e04c0be7da1aae396d4d736f6ab79585b8d0bbb4a36704b9c23db6ec7dbedd8323b6baa07f129afb851dce15d21ae85350d03ea491
SSDEEP

196608:pbZpm896G7CCcWhF4Ps71GyFoQRC79BHDTZ:plp+Ps7wyF3gBBnZ

Score

10^/10

dcrat discovery evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 25 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

WEXTRACT.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	WEXTRACT.exe
844	schtasks.exe
668	schtasks.exe
796	schtasks.exe
1148	schtasks.exe
1488	schtasks.exe
2040	schtasks.exe
1140	schtasks.exe
1256	schtasks.exe
1564	schtasks.exe
1356	schtasks.exe
1620	schtasks.exe
1568	schtasks.exe
760	schtasks.exe
524	schtasks.exe
1100	schtasks.exe
1272	schtasks.exe
1612	schtasks.exe
1784	schtasks.exe
1644	schtasks.exe
268	schtasks.exe
1344	schtasks.exe
1528	schtasks.exe
1632	schtasks.exe
1700	schtasks.exe

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	1548	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1548	schtasks.exe

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bb.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bb.exe	dcrat
\Webwinruntime\Mshyperweb.exe	dcrat
behavioral1/memory/2000-80-0x0000000000030000-0x000000000016C000-memory.dmp	dcrat
C:\Webwinruntime\Mshyperweb.exe	dcrat
\Webwinruntime\Mshyperweb.exe	dcrat
C:\Webwinruntime\Mshyperweb.exe	dcrat
C:\Users\Public\Desktop\Mshyperweb.exe	dcrat
C:\Users\Public\Desktop\Mshyperweb.exe	dcrat
behavioral1/memory/1664-99-0x00000000012E0000-0x000000000141C000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion
Executes dropped EXE 4 IoCs

Processes:

bb.exeBOOSTE~1.EXEMshyperweb.exeMshyperweb.exe

pid process

1108 bb.exe
1020 BOOSTE~1.EXE
2000 Mshyperweb.exe
1664 Mshyperweb.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1996 cmd.exe
1996 cmd.exe

pid	process
1108	bb.exe
1020	BOOSTE~1.EXE
2000	Mshyperweb.exe
1664	Mshyperweb.exe

pid	process
1996	cmd.exe
1996	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WEXTRACT.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	WEXTRACT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	WEXTRACT.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

BOOSTE~1.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BOOSTE~1.EXE
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Modifies boot configuration data using bcdedit 1 IoCs

Processes:

bcdedit.exe

pid process

1172 bcdedit.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BOOSTE~1.EXE

pid	process
1172	bcdedit.exe

Drops file in Program Files directory 15 IoCs

Processes:

Mshyperweb.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX74D7.tmp	Mshyperweb.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCX80AB.tmp	Mshyperweb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\RCXA448.tmp	Mshyperweb.exe
File created	C:\Program Files (x86)\Microsoft Office\75a57c1bdf437c	Mshyperweb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\RCXA7C2.tmp	Mshyperweb.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\f3b6ecef712a24	Mshyperweb.exe
File created	C:\Program Files (x86)\Microsoft Office\WMIADAP.exe	Mshyperweb.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe	Mshyperweb.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCX8426.tmp	Mshyperweb.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\WmiPrvSE.exe	Mshyperweb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\WMIADAP.exe	Mshyperweb.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe	Mshyperweb.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\WmiPrvSE.exe	Mshyperweb.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\24dbde2999530e	Mshyperweb.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX7842.tmp	Mshyperweb.exe

Drops file in Windows directory 6 IoCs

Processes:

Mshyperweb.exe

description	ioc	process
File created	C:\Windows\winsxs\x86_microsoft-windows-smbserver.resources_31bf3856ad364e35_6.1.7600.16385_es-es_80a90c3bf547af9a\explorer.exe	Mshyperweb.exe
File opened for modification	C:\Windows\Web\RCX9864.tmp	Mshyperweb.exe
File opened for modification	C:\Windows\Web\RCX9BDE.tmp	Mshyperweb.exe
File opened for modification	C:\Windows\Web\lsm.exe	Mshyperweb.exe
File created	C:\Windows\Web\lsm.exe	Mshyperweb.exe
File created	C:\Windows\Web\101b941d020240	Mshyperweb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BOOSTE~1.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BOOSTE~1.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BOOSTE~1.EXE

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1568	schtasks.exe
1272	schtasks.exe
1612	schtasks.exe
524	schtasks.exe
1700	schtasks.exe
268	schtasks.exe
1256	schtasks.exe
1564	schtasks.exe
760	schtasks.exe
1140	schtasks.exe
2040	schtasks.exe
1356	schtasks.exe
1620	schtasks.exe
796	schtasks.exe
1528	schtasks.exe
1632	schtasks.exe
844	schtasks.exe
668	schtasks.exe
1148	schtasks.exe
1488	schtasks.exe
1784	schtasks.exe
1644	schtasks.exe
1344	schtasks.exe
1100	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1256 reg.exe

pid	process
1256	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

BOOSTE~1.EXEMshyperweb.exeMshyperweb.exe

pid	process
1020	BOOSTE~1.EXE
1020	BOOSTE~1.EXE
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
2000	Mshyperweb.exe
1664	Mshyperweb.exe
1664	Mshyperweb.exe
1664	Mshyperweb.exe
1664	Mshyperweb.exe
1664	Mshyperweb.exe
1664	Mshyperweb.exe
1664	Mshyperweb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

BOOSTE~1.EXEMshyperweb.exeMshyperweb.exe

description pid process

Token: SeDebugPrivilege 1020 BOOSTE~1.EXE
Token: SeDebugPrivilege 2000 Mshyperweb.exe
Token: SeDebugPrivilege 1664 Mshyperweb.exe

description	pid	process
Token: SeDebugPrivilege	1020	BOOSTE~1.EXE
Token: SeDebugPrivilege	2000	Mshyperweb.exe
Token: SeDebugPrivilege	1664	Mshyperweb.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

WEXTRACT.exebb.exeBOOSTE~1.EXEWScript.execmd.exeMshyperweb.execmd.exe

description	pid	process	target process
PID 1808 wrote to memory of 1108	1808	WEXTRACT.exe	bb.exe
PID 1808 wrote to memory of 1108	1808	WEXTRACT.exe	bb.exe
PID 1808 wrote to memory of 1108	1808	WEXTRACT.exe	bb.exe
PID 1808 wrote to memory of 1108	1808	WEXTRACT.exe	bb.exe
PID 1108 wrote to memory of 2036	1108	bb.exe	WScript.exe
PID 1108 wrote to memory of 2036	1108	bb.exe	WScript.exe
PID 1108 wrote to memory of 2036	1108	bb.exe	WScript.exe
PID 1108 wrote to memory of 2036	1108	bb.exe	WScript.exe
PID 1808 wrote to memory of 1020	1808	WEXTRACT.exe	BOOSTE~1.EXE
PID 1808 wrote to memory of 1020	1808	WEXTRACT.exe	BOOSTE~1.EXE
PID 1808 wrote to memory of 1020	1808	WEXTRACT.exe	BOOSTE~1.EXE
PID 1020 wrote to memory of 1172	1020	BOOSTE~1.EXE	bcdedit.exe
PID 1020 wrote to memory of 1172	1020	BOOSTE~1.EXE	bcdedit.exe
PID 1020 wrote to memory of 1172	1020	BOOSTE~1.EXE	bcdedit.exe
PID 2036 wrote to memory of 1996	2036	WScript.exe	cmd.exe
PID 2036 wrote to memory of 1996	2036	WScript.exe	cmd.exe
PID 2036 wrote to memory of 1996	2036	WScript.exe	cmd.exe
PID 2036 wrote to memory of 1996	2036	WScript.exe	cmd.exe
PID 1996 wrote to memory of 2000	1996	cmd.exe	Mshyperweb.exe
PID 1996 wrote to memory of 2000	1996	cmd.exe	Mshyperweb.exe
PID 1996 wrote to memory of 2000	1996	cmd.exe	Mshyperweb.exe
PID 1996 wrote to memory of 2000	1996	cmd.exe	Mshyperweb.exe
PID 2000 wrote to memory of 1972	2000	Mshyperweb.exe	cmd.exe
PID 2000 wrote to memory of 1972	2000	Mshyperweb.exe	cmd.exe
PID 2000 wrote to memory of 1972	2000	Mshyperweb.exe	cmd.exe
PID 1996 wrote to memory of 1256	1996	cmd.exe	reg.exe
PID 1996 wrote to memory of 1256	1996	cmd.exe	reg.exe
PID 1996 wrote to memory of 1256	1996	cmd.exe	reg.exe
PID 1996 wrote to memory of 1256	1996	cmd.exe	reg.exe
PID 1972 wrote to memory of 1648	1972	cmd.exe	w32tm.exe
PID 1972 wrote to memory of 1648	1972	cmd.exe	w32tm.exe
PID 1972 wrote to memory of 1648	1972	cmd.exe	w32tm.exe
PID 1972 wrote to memory of 1664	1972	cmd.exe	Mshyperweb.exe
PID 1972 wrote to memory of 1664	1972	cmd.exe	Mshyperweb.exe
PID 1972 wrote to memory of 1664	1972	cmd.exe	Mshyperweb.exe

C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe
"C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bb.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bb.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Webwinruntime\2gQc8XVBJnj7TBoHD.vbe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Webwinruntime\uB8YQKcGBGDFaKvsj7SpRQl6uCT1D7.bat" "
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996

C:\Webwinruntime\Mshyperweb.exe
"C:\Webwinruntime\Mshyperweb.exe"
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LGzIOqzcol.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:1648

C:\Users\Public\Desktop\Mshyperweb.exe
"C:\Users\Public\Desktop\Mshyperweb.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
5⤵
- Modifies registry key
PID:1256

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BOOSTE~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BOOSTE~1.EXE
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\system32\bcdedit.exe
"bcdedit.exe" /enum {current} /v
3⤵
- Modifies boot configuration data using bcdedit
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MshyperwebM" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\Mshyperweb.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Mshyperweb" /sc ONLOGON /tr "'C:\Users\Public\Desktop\Mshyperweb.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MshyperwebM" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Desktop\Mshyperweb.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\Web\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Web\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\Web\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Office\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Office\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BOOSTE~1.EXE

Filesize
6.9MB

MD5
b46183170e3065a6d1ac305289dacf7a

SHA1
07e88400afa36e9306497b4ce16a8d485e1d468f

SHA256
d9523eba02d2c4b40e69e5fa5c51f1145e40f0c6d203a330c648a853a7e1af03

SHA512
64209f3a2159c5bf6bb009dff2d489c412057bd99f85c5db0da254d0646bb66106c2a7332074e35c83b52f240ac28f61c9068cb73c1f5b32404885fecd3004d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BOOSTE~1.EXE

Filesize
6.9MB

MD5
b46183170e3065a6d1ac305289dacf7a

SHA1
07e88400afa36e9306497b4ce16a8d485e1d468f

SHA256
d9523eba02d2c4b40e69e5fa5c51f1145e40f0c6d203a330c648a853a7e1af03

SHA512
64209f3a2159c5bf6bb009dff2d489c412057bd99f85c5db0da254d0646bb66106c2a7332074e35c83b52f240ac28f61c9068cb73c1f5b32404885fecd3004d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bb.exe

Filesize
1.5MB

MD5
24a066e8e54fe5a1bf3804a8a35048fd

SHA1
e0d87bec50ab8ac610b3151b04e8aba5df97f246

SHA256
1dbab2f1cce2f16f237f8207e7f3baef7463cbaadb16d7ae427b7b3e902b084b

SHA512
ee1583e64ae068849c763827c630cc998bfe2aa4882ab71185bbf49379da37d221a956791a9753a6b30e2c1d8b65dc61c41cfc48e7a4e4e6fb8ba02ad643c3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bb.exe

Filesize
1.5MB

MD5
24a066e8e54fe5a1bf3804a8a35048fd

SHA1
e0d87bec50ab8ac610b3151b04e8aba5df97f246

SHA256
1dbab2f1cce2f16f237f8207e7f3baef7463cbaadb16d7ae427b7b3e902b084b

SHA512
ee1583e64ae068849c763827c630cc998bfe2aa4882ab71185bbf49379da37d221a956791a9753a6b30e2c1d8b65dc61c41cfc48e7a4e4e6fb8ba02ad643c3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\LGzIOqzcol.bat

Filesize
203B

MD5
273fe14c22af54301dcc02d53efb2211

SHA1
8e5c05a2bff869b427a78ea9de9558ce89c1d7d3

SHA256
7eb9a701468b088995a6e8385397a52e995ad2ab4ae47a74ceeaf2ae772d3f34

SHA512
64e8a6dfbd8b8e14acb2313b89b9cac438a0359205d0f1d88ff7e436db5bcc234d8f40b26344f1abf4af499b07f9c0569fa2be20080551d2b0c7ba89cae67013

Download Submit
C:\Users\Public\Desktop\Mshyperweb.exe

Filesize
1.2MB

MD5
d73433115c697f50c96f79a03d18e8bb

SHA1
b85e8b994ecb5b2b7eb4ae34db82137eabf718d6

SHA256
a8fc667e0fcc09b0105f748d39494d84138eb2e4a31b48b5331d5d0f478fc48a

SHA512
fa86101b3649eb1c6abcd6e7c4312505f79a605d73266f2816e62e140a0beb27e34e93dfb4646040b38387f1ebfc46eacdadc79c3e5a787441db016dadc09fc6

Download Submit
C:\Users\Public\Desktop\Mshyperweb.exe

Filesize
1.2MB

MD5
d73433115c697f50c96f79a03d18e8bb

SHA1
b85e8b994ecb5b2b7eb4ae34db82137eabf718d6

SHA256
a8fc667e0fcc09b0105f748d39494d84138eb2e4a31b48b5331d5d0f478fc48a

SHA512
fa86101b3649eb1c6abcd6e7c4312505f79a605d73266f2816e62e140a0beb27e34e93dfb4646040b38387f1ebfc46eacdadc79c3e5a787441db016dadc09fc6

Download Submit
C:\Webwinruntime\2gQc8XVBJnj7TBoHD.vbe

Filesize
220B

MD5
e53776af06260079d97e3419a4b4774c

SHA1
fe4710374dd131499aebb0f3a7e1e52a41617860

SHA256
9cf240d5602aa5b0364f76267118bd3f5fa1c24f231656c98bbf7179377bda86

SHA512
5a2c9c91944b63d872ff949c32236bf8aa2bb67f426fbcb3b9c352ae64a415278a0de98b2a2015f3e4f5b5f15cae46386303f72e34ababa913bed6320bb62b3d

Download Submit
C:\Webwinruntime\Mshyperweb.exe

Filesize
1.2MB

MD5
4d52bee2a4760127acb0e831ab92a9a8

SHA1
e649e289da449b62b4c94a193e4f0ba0d1732342

SHA256
2f4c249c1af01e6279bc40e29f7eadd78e681ab62a02b80c3f6437105c6b88df

SHA512
11de1f78066164e03db0d7d4d13b53f5c788d88a44c8ddf0a68beb7f8c876b3c75fc7930a21296de52b989cd761786216f677c325220a9df1a607a5dca7f191a

Download Submit
C:\Webwinruntime\Mshyperweb.exe

Filesize
1.2MB

MD5
4d52bee2a4760127acb0e831ab92a9a8

SHA1
e649e289da449b62b4c94a193e4f0ba0d1732342

SHA256
2f4c249c1af01e6279bc40e29f7eadd78e681ab62a02b80c3f6437105c6b88df

SHA512
11de1f78066164e03db0d7d4d13b53f5c788d88a44c8ddf0a68beb7f8c876b3c75fc7930a21296de52b989cd761786216f677c325220a9df1a607a5dca7f191a

Download Submit
C:\Webwinruntime\uB8YQKcGBGDFaKvsj7SpRQl6uCT1D7.bat

Filesize
145B

MD5
83679d1d476b58992a8fc8ad71f93fc0

SHA1
784380a4a769f1e7a895f28e25ab3b5453e30036

SHA256
3a792ab697f2792e90a60b6caecd986b0c0c5642e15cc5cf0062d731e181ef8b

SHA512
d78823f10fc8e562ee556c451a50bf12a1df846fe37dce26803201271c1c81bb60c89d085cd56028853dbf3f7922aaec6c5e7cd70689dc6970c5d241d8f4cacc

Download Submit
\Webwinruntime\Mshyperweb.exe

Filesize
1.2MB

MD5
4d52bee2a4760127acb0e831ab92a9a8

SHA1
e649e289da449b62b4c94a193e4f0ba0d1732342

SHA256
2f4c249c1af01e6279bc40e29f7eadd78e681ab62a02b80c3f6437105c6b88df

SHA512
11de1f78066164e03db0d7d4d13b53f5c788d88a44c8ddf0a68beb7f8c876b3c75fc7930a21296de52b989cd761786216f677c325220a9df1a607a5dca7f191a

Download Submit
\Webwinruntime\Mshyperweb.exe

Filesize
1.2MB

MD5
4d52bee2a4760127acb0e831ab92a9a8

SHA1
e649e289da449b62b4c94a193e4f0ba0d1732342

SHA256
2f4c249c1af01e6279bc40e29f7eadd78e681ab62a02b80c3f6437105c6b88df

SHA512
11de1f78066164e03db0d7d4d13b53f5c788d88a44c8ddf0a68beb7f8c876b3c75fc7930a21296de52b989cd761786216f677c325220a9df1a607a5dca7f191a

Download Submit
memory/1020-66-0x000000001BAF0000-0x000000001BD92000-memory.dmp

Filesize
2.6MB

Download
memory/1020-69-0x0000000000BE0000-0x0000000000C06000-memory.dmp

Filesize
152KB

Download
memory/1020-70-0x0000000000D90000-0x0000000000DC0000-memory.dmp

Filesize
192KB

Download
memory/1020-87-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/1020-72-0x000000001B797000-0x000000001B7B6000-memory.dmp

Filesize
124KB

Download
memory/1020-68-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/1020-89-0x000000001B797000-0x000000001B7B6000-memory.dmp

Filesize
124KB

Download
memory/1020-67-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/1020-62-0x0000000000000000-mapping.dmp

Download
memory/1020-88-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/1020-65-0x0000000000060000-0x000000000074E000-memory.dmp

Filesize
6.9MB

Download
memory/1108-55-0x0000000000000000-mapping.dmp

Download
memory/1108-57-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1172-71-0x0000000000000000-mapping.dmp

Download
memory/1256-94-0x0000000000000000-mapping.dmp

Download
memory/1648-95-0x0000000000000000-mapping.dmp

Download
memory/1664-99-0x00000000012E0000-0x000000000141C000-memory.dmp

Filesize
1.2MB

Download
memory/1664-100-0x000000001AF26000-0x000000001AF45000-memory.dmp

Filesize
124KB

Download
memory/1664-97-0x0000000000000000-mapping.dmp

Download
memory/1664-101-0x000000001AF26000-0x000000001AF45000-memory.dmp

Filesize
124KB

Download
memory/1808-54-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Filesize
8KB

Download
memory/1972-91-0x0000000000000000-mapping.dmp

Download
memory/1996-74-0x0000000000000000-mapping.dmp

Download
memory/2000-81-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/2000-92-0x000000001AF26000-0x000000001AF45000-memory.dmp

Filesize
124KB

Download
memory/2000-85-0x00000000021F0000-0x00000000021FA000-memory.dmp

Filesize
40KB

Download
memory/2000-84-0x00000000021E0000-0x00000000021EC000-memory.dmp

Filesize
48KB

Download
memory/2000-83-0x00000000021D0000-0x00000000021E0000-memory.dmp

Filesize
64KB

Download
memory/2000-82-0x0000000000590000-0x00000000005A6000-memory.dmp

Filesize
88KB

Download
memory/2000-86-0x000000001AF26000-0x000000001AF45000-memory.dmp

Filesize
124KB

Download
memory/2000-78-0x0000000000000000-mapping.dmp

Download
memory/2000-80-0x0000000000030000-0x000000000016C000-memory.dmp

Filesize
1.2MB

Download
memory/2000-90-0x000000001AF26000-0x000000001AF45000-memory.dmp

Filesize
124KB

Download
memory/2036-59-0x0000000000000000-mapping.dmp

Download