dcrat | 2318153f6af14c4c99e8c0c106c4d5d28667a904bb1a6547a00f78ef03f3fab8

General

Target

abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exe
Size

2.6MB
MD5

09cacacf6eef86e62b26d5d1ca217c8e
SHA1

21520171163005980651861cea13fc6edc82d2da
SHA256

abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac
SHA512

fc90917fa408769cef02c977ff4a0f30a6b14e0fe0731a7ccd573c63da9523e48d58914c5a26b4f5d3d8faee47ea3d32ccbf5e462e802dd7b3cc23e6ad6fd4c6
SSDEEP

49152:ubA3jlSSI+tkWr2mvKSq32s+FBf4HrypMFQtwfRKSSutCn0:ubcSbWr2mLHyC8LSut1

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	1544	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1544	schtasks.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\hyperchainagent\Surrogaterefnet.exe	dcrat
C:\hyperchainagent\Surrogaterefnet.exe	dcrat
behavioral2/memory/3508-145-0x0000000000040000-0x0000000000292000-memory.dmp	dcrat
C:\odt\WmiPrvSE.exe	dcrat
C:\hyperchainagent\services.exe	dcrat
C:\hyperchainagent\services.exe	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exeWScript.exeSurrogaterefnet.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	Surrogaterefnet.exe

Executes dropped EXE 2 IoCs

Processes:

Surrogaterefnet.exeservices.exe

pid process

3508 Surrogaterefnet.exe
1416 services.exe

Drops file in Program Files directory 2 IoCs

Processes:

Surrogaterefnet.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	Surrogaterefnet.exe
File created	C:\Program Files (x86)\Windows Portable Devices\cc11b995f2a76d	Surrogaterefnet.exe

Drops file in Windows directory 3 IoCs

Processes:

Surrogaterefnet.exe

description	ioc	process
File created	C:\Windows\CbsTemp\StartMenuExperienceHost.exe	Surrogaterefnet.exe
File created	C:\Windows\CbsTemp\55b276f4edf653	Surrogaterefnet.exe
File created	C:\Windows\Boot\Misc\RuntimeBroker.exe	Surrogaterefnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3872	schtasks.exe
5100	schtasks.exe
1880	schtasks.exe
2064	schtasks.exe
5012	schtasks.exe
4476	schtasks.exe
760	schtasks.exe
3968	schtasks.exe
836	schtasks.exe
2380	schtasks.exe
2544	schtasks.exe
4720	schtasks.exe
1200	schtasks.exe
1668	schtasks.exe
1056	schtasks.exe
2204	schtasks.exe
736	schtasks.exe
4972	schtasks.exe
4060	schtasks.exe
4728	schtasks.exe
3692	schtasks.exe
2284	schtasks.exe
1300	schtasks.exe
1420	schtasks.exe
3888	schtasks.exe
3528	schtasks.exe
2128	schtasks.exe
2480	schtasks.exe
4880	schtasks.exe
1376	schtasks.exe

Modifies registry class 2 IoCs

Processes:

abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exeSurrogaterefnet.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	Surrogaterefnet.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Surrogaterefnet.exeservices.exe

pid	process
3508	Surrogaterefnet.exe
3508	Surrogaterefnet.exe
3508	Surrogaterefnet.exe
3508	Surrogaterefnet.exe
3508	Surrogaterefnet.exe
3508	Surrogaterefnet.exe
3508	Surrogaterefnet.exe
3508	Surrogaterefnet.exe
3508	Surrogaterefnet.exe
1416	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Surrogaterefnet.exeservices.exe

description pid process

Token: SeDebugPrivilege 3508 Surrogaterefnet.exe
Token: SeDebugPrivilege 1416 services.exe

description	pid	process
Token: SeDebugPrivilege	3508	Surrogaterefnet.exe
Token: SeDebugPrivilege	1416	services.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exeWScript.execmd.exeSurrogaterefnet.execmd.exe

description	pid	process	target process
PID 3600 wrote to memory of 4836	3600	abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exe	WScript.exe
PID 3600 wrote to memory of 4836	3600	abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exe	WScript.exe
PID 3600 wrote to memory of 4836	3600	abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exe	WScript.exe
PID 4836 wrote to memory of 4912	4836	WScript.exe	cmd.exe
PID 4836 wrote to memory of 4912	4836	WScript.exe	cmd.exe
PID 4836 wrote to memory of 4912	4836	WScript.exe	cmd.exe
PID 4912 wrote to memory of 3508	4912	cmd.exe	Surrogaterefnet.exe
PID 4912 wrote to memory of 3508	4912	cmd.exe	Surrogaterefnet.exe
PID 3508 wrote to memory of 3764	3508	Surrogaterefnet.exe	cmd.exe
PID 3508 wrote to memory of 3764	3508	Surrogaterefnet.exe	cmd.exe
PID 3764 wrote to memory of 3600	3764	cmd.exe	w32tm.exe
PID 3764 wrote to memory of 3600	3764	cmd.exe	w32tm.exe
PID 3764 wrote to memory of 1416	3764	cmd.exe	services.exe
PID 3764 wrote to memory of 1416	3764	cmd.exe	services.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exe
"C:\Users\Admin\AppData\Local\Temp\abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3600

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\hyperchainagent\hVasfh5Xz1.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\hyperchainagent\DMBt2834kk6smlkgJa5RvPFxYK.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4912

C:\hyperchainagent\Surrogaterefnet.exe
"C:\hyperchainagent\Surrogaterefnet.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YrtOwsvoxA.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:3600

C:\hyperchainagent\services.exe
"C:\hyperchainagent\services.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\CbsTemp\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\CbsTemp\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\CbsTemp\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\odt\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\hyperchainagent\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\hyperchainagent\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\hyperchainagent\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\YrtOwsvoxA.bat
Filesize
196B

MD5
c2536f835f2f08d9a859747a4bf7ae54

SHA1
2390ac622e90d7829f67c2bec3e01026f77ffb65

SHA256
b7fa163fa74d289a949da09b5b4473857e30d1c75f980aa50d582fcd20846da2

SHA512
2acac93922c385af887e92a954131ada76080e6655fde2a4188d8ca11c25a5f7ca19b1eb95fd18ed9215c1f662206c59f30e95da1c06d1e307a8b2ce632c6cfb

Download Submit
C:\hyperchainagent\DMBt2834kk6smlkgJa5RvPFxYK.bat
Filesize
40B

MD5
9cbc6ed294d7df3d71188be1778d1e84

SHA1
49ea3428916b3fbbb817df9f40bd7fd3385dfb1e

SHA256
91bb54ba35c1ac167d6eedccd1b18f9178426f21aefcf14ac488e09dbb798af8

SHA512
7303ae61150beb18504db411371d2d6e0383f2f3e7a7e3f5f7e7feffa5cbce4fc9b1225474f57050c99f32d3adcbff7f8cab41e4f9edd78a5c26c15e95dea06a

Download Submit
C:\hyperchainagent\Surrogaterefnet.exe
Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\hyperchainagent\Surrogaterefnet.exe
Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\hyperchainagent\hVasfh5Xz1.vbe
Filesize
218B

MD5
16389aa806a3fd9a2322e3fbcddacede

SHA1
03c06c620f9717650013b8d2c30ca4a67d4e1939

SHA256
f2e9cef08cce338bbc9d5eea18059a3df236f4ca5a050bce564a94347dbc1742

SHA512
9d04db24f78c9a947510e32196d31380db479425cf52752231e1b0df44da43356c7e010f3dd9c79a446b05ca61ec35fbb2de5762f221b7aa1d9555d71555ea91

Download Submit
C:\hyperchainagent\services.exe
Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\hyperchainagent\services.exe
Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
C:\odt\WmiPrvSE.exe
Filesize
2.3MB

MD5
dbf705ce9641d7783c9e867a15d463dc

SHA1
e14b23c79cdc102ef10cb35ce78e84a50e725549

SHA256
ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3

SHA512
4ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81

Download Submit
memory/3508-145-0x0000000000040000-0x0000000000292000-memory.dmp

Filesize
2.3MB

Download
memory/3508-146-0x000000001AEB0000-0x000000001AEC0000-memory.dmp

Filesize
64KB

Download
memory/3508-147-0x000000001C1A0000-0x000000001C1F0000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads